PT-2026-8085 · WordPress · Press3D

Athiwat Tiprasaharn + 1 · Published 2026-02-14 · Updated 2026-02-14 · CVE-2026-1985

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Press3D plugin for WordPress versions up to and including 1.0.2

Description The Press3D plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 3D Model Gutenberg block. The plugin does not properly sanitize and validate URL schemes when storing link URLs for 3D model blocks, permitting the use of javascript: URLs. This allows authenticated attackers with Author-level access or higher to inject arbitrary web scripts into pages via the link URL parameter. These scripts will execute when a user clicks on the 3D model.

Recommendations Update the Press3D plugin to a version beyond 1.0.2.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-1985

Affected Products

Press3D

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-1985 · Security Note
• https://cwe.mitre.org/data/definitions/79.html · Note
• https://twitter.com/VulmonFeeds/status/2022650496066920842 · Twitter Post
• https://plugins.trac.wordpress.org/browser/press3d/trunk/press3d.php#L1 · Note
• https://twitter.com/CVEnew/status/2022567889459654954 · Twitter Post
• https://plugins.trac.wordpress.org/browser/press3d/tags/1.0.2/press3d.php#L1 · Note
• https://developer.wordpress.org/reference/functions/esc_url · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/e153bb3d-e175-48bd-894c-7ccb8f09fec4?source=cve · Note
• https://t.me/CVEtracker/44709 · Telegram Post