What is the CVSS score of CVE-2026-3997?

CVE-2026-3997 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-3997?

Organizations using all should be aware of moderate risk from CVE-2026-3997, a cross-site scripting vulnerability rated CVSS 6.4.

How to fix or mitigate CVE-2026-3997?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-3997

EUVD-2026-14157 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 Wordfence

GHSA-m3x9-6r4v-vvcw

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14157

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:27 nvd

MEDIUM 6.4

DescriptionCVE.org

The Text Toggle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' shortcode attribute of the [tt_part] and [tt] shortcodes in all versions up to and including 1.1. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. Specifically, in the avp_texttoggle_part_shortcode() function, the 'title' attribute is extracted from shortcode attributes and concatenated directly into HTML output without any escaping - both within an HTML attribute context (title="...") on line 116 and in HTML content on line 119. While the 'class' attribute is properly validated using ctype_alnum(), the 'title' attribute has no sanitization whatsoever. An attacker can inject double-quote characters to break out of the title attribute and inject arbitrary HTML attributes including event handlers. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

The Text Toggle WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to 1.1 affecting the 'title' shortcode attribute of the [tt_part] and [tt] shortcodes. Authenticated attackers with Contributor-level privileges or above can inject arbitrary HTML attributes and event handlers by breaking out of the title attribute context, allowing malicious scripts to execute in the browsers of any user viewing affected pages. The vulnerability is classified as medium severity (CVSS 6.4) and requires authentication, but impacts site integrity and visitor security across any WordPress installation using this plugin.

Technical ContextAI

The vulnerability exists in the avp_texttoggle_part_shortcode() function within the Text Toggle plugin (cpe:2.3:a:hoosierdragon:text_toggle), where shortcode attributes are processed without proper output encoding. The root cause is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), a class of input validation and output encoding defects. Specifically, the 'title' attribute is extracted from user-supplied shortcode parameters and directly concatenated into HTML output in two contexts: as an HTML attribute value (line 116: title="...") and within HTML content (line 119), without any sanitization or escaping functions like wp_kses_post() or esc_attr(). While the 'class' attribute is protected via ctype_alnum() validation, the 'title' attribute receives no filtering, allowing double-quote injection to break attribute boundaries and inject event handlers such as onmouseover, onclick, or onerror.

RemediationAI

Upgrade the Text Toggle plugin to a patched version released after the disclosure of this vulnerability (confirm with the plugin vendor or Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/d7ac0683-120f-4e76-9d44-5ee1c789b2c8). If a patch is not yet available, disable the plugin immediately by deactivating and removing it from the WordPress plugin directory, as the vulnerability is trivial to exploit once an attacker gains Contributor access. As a temporary mitigation pending patch availability, restrict Contributor-level role assignments to only essential trusted users and audit existing contributor accounts for unauthorized creation. Additionally, implement WordPress security hardening via Web Application Firewall (WAF) rules to detect and block XSS payloads in shortcode attributes, though this is not a substitute for patching. Monitor all pages using [tt_part] or [tt] shortcodes for injected event handlers in revision history.