Is Prismatic affected by CVE-2026-3876?

The Prismatic WordPress plugin (versions ≤3.7.3) contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through comment submissions, potentially compromising site visitors and administrative accounts.

CVE-2026-3876

EUVD-2026-23212 HIGH

2026-04-16 Wordfence

XSS WordPress Prismatic

7.2

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 16, 2026 - 07:50 vuln.today

DescriptionNVD

The Prismatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'prismatic_encoded' pseudo-shortcode in all versions up to, and including, 3.7.3. This is due to insufficient input sanitization and output escaping on user-supplied attributes within the 'prismatic_decode' function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page by submitting a comment containing a crafted 'prismatic_encoded' pseudo-shortcode.

AnalysisAI

Stored Cross-Site Scripting in Prismatic WordPress plugin (all versions ≤3.7.3) allows unauthenticated remote attackers to inject malicious scripts via crafted comment submissions containing the 'prismatic_encoded' pseudo-shortcode. Vulnerable code in prismatic_decode function fails to sanitize user-supplied attributes. …

RemediationAI

Within 24 hours: Verify all WordPress installations using Prismatic plugin and confirm current version via admin dashboard (Plugins > Installed Plugins). Within 7 days: Update Prismatic plugin to version 3.7.4 or later via WordPress admin panel (Plugins > Updates) or manually deploy the patched version. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

CVE-2026-3876 vulnerability details – vuln.today

Back

CVE-2026-3876

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

RemediationAI

Full analysis requires sign-in

Share

External POC / Exploit Code