CVE-2026-3368: XSS in WordPress Injection Guard Plugin

An attacker can exploit this XSS vulnerability by crafting malicious URLs containing specially crafted query parameters. The plugin's sanitizeigdata() function fails to properly sanitize array keys, allowing attackers to inject arbitrary JavaScript code. This code will then be executed in the context of the user's browser when they visit a page containing the malicious URL. Successful exploitation could lead to session hijacking, defacement of the website, or redirection to malicious sites. The lack of output escaping in ig_settings.php exacerbates the issue, directly echoing unsanitized data into the HTML.

1. Reserved2026-02-27
2. Published2026-03-20
3. Modified2026-04-08
4. EPSS updated2026-03-28

The primary mitigation is to upgrade the WordPress Injection Guard plugin to version 1.3.0 or later, which addresses the sanitization and escaping flaws. If immediate upgrading is not possible, consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious query parameter names. Specifically, look for patterns that attempt to inject JavaScript code. Additionally, review and sanitize any user-supplied data before displaying it on the website. After upgrading, confirm the fix by attempting to inject a simple JavaScript payload via a query parameter and verifying that it is not executed.

Active installs

1KNiche

Plugin rating