PT-2026-34277 · WordPress · Short Comment Filter

Published 2026-04-22 · Updated 2026-04-23 · CVE-2026-3362

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Short Comment Filter versions prior to 2.3

Description The Short Comment Filter plugin for WordPress contains a Stored Cross-Site Scripting issue. The problem exists because the 'Minimum Count' settings field lacks proper input sanitization and output escaping. Specifically, there is no sanitize callback on register setting and the value is echoed without using esc attr() in the HTML attribute context. Authenticated attackers with administrator-level access or higher can inject arbitrary web scripts into the settings page, which execute when a user visits that page. This is especially significant in WordPress multisite installations or environments where DISALLOW UNFILTERED HTML is enabled, restricting the unfiltered html capability for administrators.

Recommendations Update to a version later than 2.2.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-3362

Affected Products

Short Comment Filter

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2026-3362 · Security Note
• https://twitter.com/VulmonFeeds/status/2046958427851661567 · Twitter Post
• https://plugins.trac.wordpress.org/browser/short-comment-filter/tags/2.2/classes/short-comment-filter-settings.php#L54 · Note
• https://twitter.com/CVEnew/status/2047428129896202386 · Twitter Post
• https://plugins.trac.wordpress.org/browser/short-comment-filter/trunk/classes/short-comment-filter-settings.php#L61 · Note
• https://plugins.trac.wordpress.org/browser/short-comment-filter/trunk/classes/short-comment-filter-settings.php#L54 · Note
• https://plugins.trac.wordpress.org/browser/short-comment-filter/tags/2.2/classes/short-comment-filter-settings.php#L21 · Note
• https://plugins.trac.wordpress.org/browser/short-comment-filter/trunk/views/settings.php#L25 · Note
• https://plugins.trac.wordpress.org/browser/short-comment-filter/tags/2.2/views/settings.php#L25 · Note
• https://plugins.trac.wordpress.org/browser/short-comment-filter/tags/2.2/classes/short-comment-filter-settings.php#L61 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/4ba46475-bf54-49a8-9b0e-fae3fb4e1df9?source=cve · Note
• https://plugins.trac.wordpress.org/browser/short-comment-filter/trunk/classes/short-comment-filter-settings.php#L21 · Note