CVE-2026-3362Disclosure

LOWCVSS 4.4 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

The Short Comment Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Minimum Count' settings field in all versions up to and including 2.2. This is due to insufficient input sanitization (no sanitize callback on register_setting) and missing output escaping (no esc_attr() on the echoed value in the input's value attribute). The option value is stored via update_option() and rendered unescaped in an HTML attribute context. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in the settings page that will execute whenever a user accesses that page. This is particularly impactful in WordPress multisite installations or when DISALLOW_UNFILTERED_HTML is set, where administrators are not granted the unfiltered_html capability.

Back to dashboard

1.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

Public PoC is present in monitored signal
3 mentions across 3 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Technical details provided in 3 signals
Disclosure: 2 classified signals
Peaked 2d ago at 1 mentions (2026-04-22); latest day: 1
3 total mentions across 3 days

Deep dive

Activity timeline3 mentions / 3d

Signal classification2 categories

Disclosure

266.7%

PoC

133.3%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-22	1	Disclosure1
2026-04-23	1	Disclosure1
2026-04-24	1	PoC1

Full discourse3 posts

Atomic Edge@atomicedgeWAF167d
PoC
https://atomicedge.io/cve-proof/cve-2026-3362-short-comment-filter-version-2-2-medium-vulnerability-proof-of-concept CVE-2026-3362 #WordPress plugin #vulnerability short-comment-filter #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge
Post summary
The post shares a proof-of-concept for CVE‑2026‑3362 affecting the Short Comment Filter 2.2 plugin, with no mention of active exploitation, patches, or false positives.
0000047
6 followersView on X
CVE@CVEnew168d
Disclosure
CVE-2026-3362 The Short Comment Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Minimum Count' settings field in all versions up to and including 2.… https://www.cve.org/CVERecord?id=CVE-2026-3362
Post summary
The CVE-2026-3362 announcement identifies a stored cross‑site scripting flaw in the Short Comment Filter WordPress plugin for versions up to 2, without mentioning PoC, exploitation details, or patches.
00000133
57.2K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds169d
Disclosure
CVE-2026-3362 Stored Cross-Site Scripting in Short Comment Filter Plugin for WordPress 2.2 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-3362
Post summary
The text announces CVE-2026-3362 as a stored XSS vulnerability in a specific WordPress plugin, providing the vulnerability type and affected component, with no evidence of exploitation or mitigations.
0000050
4.0K followersView on X

Explore more

Back to dashboard