What is the CVSS score of CVE-2026-3876?

CVE-2026-3876 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Prismatic are affected by CVE-2026-3876?

The Prismatic WordPress plugin (versions ≤3.7.3) contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through comment submissions,…

How to fix or mitigate CVE-2026-3876?

Within 24 hours: Verify all WordPress installations using Prismatic plugin and confirm current version via admin dashboard (Plugins > Installed Plugins). Within 7 days: Update Prismatic plugin to version 3.7.4 or later via WordPress admin panel (Plugins > Updates) or manually deploy the patched version. Within 30 days: Conduct security audit of existing comments for injected malicious scripts; consider temporarily disabling comments on affected sites if update is delayed; enable WordPress security monitoring for comment-based threats.

Prismatic CVE-2026-3876

EUVD-2026-23212 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-04-16 Wordfence

WordPress XSS Prismatic Wordpress Plugin Specialk

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 20:37 vuln.today

cvss_changed

Analysis Generated

Apr 16, 2026 - 07:50 vuln.today

EUVD ID Assigned

Apr 16, 2026 - 07:30 euvd

EUVD-2026-23212

Analysis Generated

Apr 16, 2026 - 07:30 vuln.today

CVE Published

Apr 16, 2026 - 06:44 nvd

HIGH 7.2

DescriptionCVE.org

The Prismatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'prismatic_encoded' pseudo-shortcode in all versions up to, and including, 3.7.3. This is due to insufficient input sanitization and output escaping on user-supplied attributes within the 'prismatic_decode' function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page by submitting a comment containing a crafted 'prismatic_encoded' pseudo-shortcode.

AnalysisAI

Stored Cross-Site Scripting in Prismatic WordPress plugin (all versions ≤3.7.3) allows unauthenticated remote attackers to inject malicious scripts via crafted comment submissions containing the 'prismatic_encoded' pseudo-shortcode. Vulnerable code in prismatic_decode function fails to sanitize user-supplied attributes. CVSS 7.2 with scope change (S:C) elevates impact beyond vulnerable component. EPSS data not available; no CISA KEV listing identified. Wordfence threat intelligence confirms vulnerability; patch released in version 3.7.4 per WordPress plugin repository changelog.

Technical ContextAI

The Prismatic plugin (CPE: cpe:2.3:a:specialk:prismatic) provides syntax highlighting and code display functionality for WordPress through shortcodes. The vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) exists in the prismatic_decode function within inc/prismatic-core.php. This function processes the 'prismatic_encoded' pseudo-shortcode but fails to properly sanitize attributes before rendering. WordPress allows unauthenticated users to submit comments by default, and the plugin processes shortcodes within comment content. When malicious JavaScript is embedded in shortcode attributes, it gets stored in the WordPress database and executed in victims' browsers when rendering pages containing the crafted comment. The CVSS scope change (S:C) indicates the vulnerability can impact resources beyond the plugin's security boundary, affecting the broader WordPress site context including admin sessions and other user data.

RemediationAI

Update Prismatic plugin to version 3.7.4 or later immediately through WordPress admin dashboard (Plugins > Installed Plugins > Prismatic > Update) or via WP-CLI command 'wp plugin update prismatic'. Version 3.7.4 implements proper input sanitization in the prismatic_decode function per changeset at https://plugins.trac.wordpress.org/changeset?old_path=/prismatic/tags/3.7.3/inc/prismatic-core.php&new_path=/prismatic/tags/3.7.4/inc/prismatic-core.php. If immediate patching is not feasible, implement these compensating controls: (1) Enable comment moderation in WordPress Settings > Discussion > 'Comment must be manually approved' to prevent malicious comments from publishing automatically (trade-off: increased administrative overhead reviewing legitimate comments), (2) Temporarily disable the Prismatic plugin if syntax highlighting is non-essential (trade-off: loss of code display functionality), (3) Implement Web Application Firewall (WAF) rules to block 'prismatic_encoded' strings in POST requests to wp-comments-post.php endpoint (trade-off: may generate false positives if legitimate users reference the shortcode name). After patching, audit existing comments for suspicious prismatic_encoded shortcode usage via database query: SELECT * FROM wp_comments WHERE comment_content LIKE '%prismatic_encoded%' and review/sanitize any findings. Consult Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/aa4e18b0-f871-4476-af92-42e55aabdf93?source=cve for additional mitigation guidance.