Das Prismatic Plugin für WordPress ist anfällig für Stored Cross-Site Scripting über den 'prismatic_encoded' Pseudo-Shortcode in allen Versionen bis einschließlich 3.7.3. Dies liegt an unzureichender Eingabevalidierung und Ausgabekodierung für benutzerdefinierte Attribute innerhalb der Funktion 'prismatic_decode'. Dadurch können nicht authentifizierte Angreifer beliebige Web-Skripte in Seiten injizieren, die ausgeführt werden, wenn ein Benutzer auf eine injizierte Seite zugreift, indem er einen Kommentar mit einem craf

An attacker can exploit this XSS vulnerability by crafting a malicious 'prismatic_encoded' pseudo-shortcode within a comment and submitting it to a WordPress site using the vulnerable Prismatic plugin. When a user views the comment containing the injected script, the script will execute in their browser context. This can allow the attacker to steal session cookies, redirect the user to a phishing site, or modify the content of the page. The impact is particularly severe because the vulnerability is stored, meaning the malicious script persists until the comment is removed, potentially affecting multiple users over time. This type of XSS is similar to other stored XSS vulnerabilities that have been exploited to compromise WordPress sites and steal user credentials.

Websites using the Prismatic WordPress plugin, especially those with public comment sections or forums, are at risk. Shared hosting environments where multiple WordPress sites share the same server resources are particularly vulnerable, as a compromise on one site could potentially impact others.

• wordpress / composer / npm:

grep -r 'prismatic_encoded' /var/www/html/wp-content/plugins/prismatic/

• wordpress / composer / npm:

wp plugin list | grep prismatic

• wordpress / composer / npm:

wp plugin update prismatic

• generic web: Inspect comment fields for suspicious shortcode usage, particularly those containing encoded characters.

1. 2026-04-16Disclosure

   disclosure

Aktive Installationen

2KNische

Plugin-Bewertung

4.8

Erfordert WordPress

4.7+

Kompatibel bis

7.0

Erfordert PHP

5.6.20+

1. Reserviert2026-03-10
2. Veröffentlicht2026-04-16
3. Geändert2026-04-22
4. EPSS aktualisiert2026-04-23

The primary mitigation for CVE-2026-3876 is to upgrade the Prismatic WordPress plugin to version 3.7.4 or later. If an immediate upgrade is not possible due to compatibility issues or breaking changes, consider temporarily disabling the Prismatic plugin to prevent new comment submissions. Web Application Firewalls (WAFs) configured to detect and block XSS payloads targeting shortcodes might offer some protection, but this is not a substitute for patching. Review existing WordPress comments for suspicious 'prismaticencoded' shortcodes and remove any found. After upgrading, verify the fix by attempting to submit a comment containing a crafted 'prismaticencoded' shortcode and confirming that the script does not execute.