What is the CVSS score of CVE-2026-4267?

CVE-2026-4267 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-4267?

Organizations using all should be aware of moderate risk from CVE-2026-4267 rated CVSS 6.1. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-4267?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

WordPress CVE-2026-4267

EUVD-2026-17397 HIGH

Basic XSS (CWE-80)

2026-03-19 https://github.com/johnbillion/query-monitor

GHSA-2xr4-chcf-vmvf

WordPress XSS

7.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:22 vuln.today

cvss_changed

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 19, 2026 - 20:00 euvd

EUVD-2026-17397

Analysis Generated

Mar 19, 2026 - 20:00 vuln.today

CVE Published

Mar 19, 2026 - 19:37 nvd

HIGH 7.2

DescriptionGitHub Advisory

Impact

The Query Monitor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $_SERVER['REQUEST_URI'] parameter in all versions up to, and including, 3.20.3 due to insufficient output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an Administrator-level user into performing an action such as clicking on a link.

On admin requests, the plugin reads user controlled data from $_SERVER['REQUEST_URI'] and stores it in the request field, then renders request, matched_query, and query_string through format_url(). If the attacker supplied string does not contain &, format_url() returns it without HTML escaping, which allows injected HTML or JavaScript from the request target to be inserted directly into the page inside a <code> element and executed in the victim's browser.

Patches

This issue has been patched in Query Monitor 3.20.4.

Credits

Many thanks to Dmitrii Ignatyev at CleanTalk for responsibly disclosing this vulnerability.

How can I report a security bug?

You can submit a private security vulnerability report to Query Monitor via the Security tab on the GitHub repo. The GitHub Security Advisory process facilitates private collaboration on security issues. You'll receive credit for a valid report and a CVE if necessary.

AnalysisAI

Query Monitor, a WordPress debugging plugin, contains a Reflected Cross-Site Scripting (XSS) vulnerability in versions up to 3.20.3 where user-controlled data from REQUEST_URI is insufficiently escaped before rendering in the admin interface. Unauthenticated attackers can craft malicious links that, when clicked by Administrator users, execute arbitrary JavaScript in their browser context. The vulnerability has a CVSS score of 6.1 (Medium) and requires user interaction, but represents a direct attack vector against high-privilege WordPress administrators.

Technical ContextAI

Query Monitor (pkg:composer/johnbillion_query-monitor) is a WordPress debugging plugin that intercepts and displays database queries and other debugging information in the admin panel. The vulnerability stems from improper output encoding in the format_url() function, which processes the REQUEST_URI server variable—a user-controlled input derived from the HTTP request URI. The root cause is CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page), where the plugin fails to HTML-escape data before inserting it into a <code> element within the admin page. When the attacker-supplied REQUEST_URI string lacks an ampersand character, the format_url() function returns it unescaped, allowing injected HTML and JavaScript payloads to execute with the privileges of the accessing Administrator.

RemediationAI

Immediately upgrade Query Monitor to version 3.20.4 or later, which includes proper HTML escaping in the format_url() function. Site administrators can perform this upgrade through the WordPress admin dashboard's Plugins > Updates interface or via Composer for programmatic deployments. The official security advisory is available at https://github.com/johnbillion/query-monitor/security/advisories/GHSA-2xr4-chcf-vmvf. Until patching is possible, consider temporarily disabling Query Monitor on production WordPress instances (it is primarily a development tool) and restrict admin panel access via firewall rules or IP whitelisting to trusted networks only. Additionally, ensure Administrator accounts use strong, unique passwords and consider enabling two-factor authentication to mitigate the risk of credential-based attacks targeting high-privilege users.