PT-2026-34277 · Itsananderson · Short Comment Filter
Published
2026-04-22
·
Updated
2026-04-22
·
CVE-2026-3362
CVSS v3.1
4.4
Medium
| AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N |
The Short Comment Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Minimum Count' settings field in all versions up to and including 2.2. This is due to insufficient input sanitization (no sanitize callback on register setting) and missing output escaping (no esc attr() on the echoed value in the input's value attribute). The option value is stored via update option() and rendered unescaped in an HTML attribute context. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in the settings page that will execute whenever a user accesses that page. This is particularly impactful in WordPress multisite installations or when DISALLOW UNFILTERED HTML is set, where administrators are not granted the unfiltered html capability.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Short Comment Filter