PT-2026-24590 · Brainstorm Force · Astra
Alex Hickey
·
Publicado
2026-03-11
·
Atualizado
2026-03-15
·
CVE-2026-3534
CVSS v3.1
6.4
Média
| Vetor | AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Astra theme for WordPress versions through 4.12.3
Description
The Astra theme for WordPress is susceptible to Stored Cross-Site Scripting through the
ast-page-background-meta and ast-content-background-meta post meta fields. This is caused by inadequate input sanitization during meta registration and a lack of output escaping within the astra get responsive background obj() function. Specifically, the function fails to properly escape four CSS-context sub-properties: background-color, background-image, overlay-color, and overlay-gradient. Authenticated attackers with Contributor-level access or higher can inject malicious web scripts into pages. These scripts will then execute whenever a user accesses the compromised page. The vulnerable function is astra get responsive background obj().Recommendations
Update the Astra theme to a version beyond 4.12.3.
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Astra