PT-2026-26848 · WordPress · Xhanch – My Advanced Settings

Published 2026-03-21 · Updated 2026-03-21 · CVE-2026-3332

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Xhanch - My Advanced Settings plugin for WordPress versions up to and including 1.1.2

Description The software is susceptible to Cross-Site Request Forgery due to missing nonce validation in the xms setting() function, specifically within the settings update handler. This allows unauthenticated attackers to modify plugin settings through a forged request if they can trick a site administrator into performing an action. Modifiable settings include the favicon URL and Google Analytics account ID, as well as various WordPress behavior toggles. The favicon url and ga acc id values are output on the front-end without proper escaping, potentially leading to a Cross-Site Request Forgery to Stored Cross-Site Scripting chain.

Recommendations Update Xhanch - My Advanced Settings plugin for WordPress to a version later than 1.1.2.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-3332

Affected Products

Xhanch – My Advanced Settings

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-3332 · Security Note
• https://plugins.trac.wordpress.org/browser/xhanch-my-advanced-settings/trunk/admin/setting.php#L10 · Note
• https://twitter.com/CVEnew/status/2035237276847153311 · Twitter Post
• https://plugins.trac.wordpress.org/browser/xhanch-my-advanced-settings/tags/1.1.2/admin/setting.php#L10 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/66dd73c5-1cf1-484e-b847-afe357fb2598?source=cve · Note