{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3362", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-27T19:52:23.019Z", "datePublished": "2026-04-22T07:45:34.704Z", "dateUpdated": "2026-04-22T07:45:34.704Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-22T07:45:34.704Z"}, "affected": [{"vendor": "itsananderson", "product": "Short Comment Filter", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Short Comment Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Minimum Count' settings field in all versions up to and including 2.2. This is due to insufficient input sanitization (no sanitize callback on register_setting) and missing output escaping (no esc_attr() on the echoed value in the input's value attribute). The option value is stored via update_option() and rendered unescaped in an HTML attribute context. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in the settings page that will execute whenever a user accesses that page. This is particularly impactful in WordPress multisite installations or when DISALLOW_UNFILTERED_HTML is set, where administrators are not granted the unfiltered_html capability."}], "title": "Short Comment Filter <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Minimum Count' Setting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4ba46475-bf54-49a8-9b0e-fae3fb4e1df9?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/short-comment-filter/trunk/views/settings.php#L25"}, {"url": "https://plugins.trac.wordpress.org/browser/short-comment-filter/tags/2.2/views/settings.php#L25"}, {"url": "https://plugins.trac.wordpress.org/browser/short-comment-filter/trunk/classes/short-comment-filter-settings.php#L61"}, {"url": "https://plugins.trac.wordpress.org/browser/short-comment-filter/tags/2.2/classes/short-comment-filter-settings.php#L61"}, {"url": "https://plugins.trac.wordpress.org/browser/short-comment-filter/trunk/classes/short-comment-filter-settings.php#L54"}, {"url": "https://plugins.trac.wordpress.org/browser/short-comment-filter/tags/2.2/classes/short-comment-filter-settings.php#L54"}, {"url": "https://plugins.trac.wordpress.org/browser/short-comment-filter/trunk/classes/short-comment-filter-settings.php#L21"}, {"url": "https://plugins.trac.wordpress.org/browser/short-comment-filter/tags/2.2/classes/short-comment-filter-settings.php#L21"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Nur Ibnu Hubab"}], "timeline": [{"time": "2026-04-21T19:16:14.000Z", "lang": "en", "value": "Disclosed"}]}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Short Comment Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Minimum Count' settings field in all versions up to and including 2.2. This is due to insufficient input sanitization (no sanitize callback on register_setting) and missing output escaping (no esc_attr() on the echoed value in the input's value attribute). The option value is stored via update_option() and rendered unescaped in an HTML attribute context. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in the settings page that will execute whenever a user accesses that page. This is particularly impactful in WordPress multisite installations or when DISALLOW_UNFILTERED_HTML is set, where administrators are not granted the unfiltered_html capability."}], "id": "CVE-2026-3362", "lastModified": "2026-04-22T09:16:21.757", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2026-04-22T09:16:21.757", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/short-comment-filter/tags/2.2/classes/short-comment-filter-settings.php#L21"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/short-comment-filter/tags/2.2/classes/short-comment-filter-settings.php#L54"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/short-comment-filter/tags/2.2/classes/short-comment-filter-settings.php#L61"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/short-comment-filter/tags/2.2/views/settings.php#L25"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/short-comment-filter/trunk/classes/short-comment-filter-settings.php#L21"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/short-comment-filter/trunk/classes/short-comment-filter-settings.php#L54"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/short-comment-filter/trunk/classes/short-comment-filter-settings.php#L61"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/short-comment-filter/trunk/views/settings.php#L25"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4ba46475-bf54-49a8-9b0e-fae3fb4e1df9?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T09:53:41.141579+00:00", "value": {"mitigation_remediation": ["Upgrade the Short Comment Filter plugin to a release newer than 2.2 that implements proper input sanitization and output escaping for the 'Minimum Count' setting.", "If an upgrade is not available, disable or delete the Short Comment Filter plugin entirely to eliminate the risk.", "Manually sanitize any remaining 'Minimum Count' values by editing the option in the database to ensure only numeric characters are stored, or use a code snippet that forcibly casts the value to an integer before rendering.", "Restrict the administrator role to trusted users and review user capabilities on multisite networks."], "summary": {"action": "Apply patch", "impact": "Stored Cross\u2011Site Scripting with administrator privileges"}, "threat_synthesis": {"affected_systems": "This flaw affects all WordPress installations running itsananderson's Short Comment Filter plugin with a version 2.2 or earlier. The issue is especially relevant for multisite networks or where the DISALLOW_UNFILTERED_HTML constant is set, because administrators normally lack the unfiltered_html capability yet still can inject code via the settings page.", "description_and_impact": "The Short Comment Filter plugin for WordPress, versions up to 2.2, suffers from a stored cross\u2011site scripting vulnerability (CWE\u201179) in the 'Minimum Count' settings field. The plugin registers the option without a sanitize callback, and the value is echoed inside an HTML attribute without escaping. An authenticated administrator can enter arbitrary JavaScript, which will be executed whenever the settings page is loaded by any user, potentially compromising the entire blog.", "risk_and_exploitability": "The CVSS score of 4.4 denotes moderate risk. Exploitation requires valid administrator credentials, but the injected payload is stored indefinitely and will run for every visitor of the settings page, including other admins. With no EPSS data and absence from the CISA KEV catalog, widespread exploitation is currently unreported, but the persistence of the payload makes it a significant concern in shared admin environments."}}}}, "created": "2026-04-22T10:00:10.250866+00:00", "updated": "2026-04-22T10:00:10.250876+00:00", "vendors": []}