Platform
wordpress
Component
prismatic
Fixed in
3.7.4
3.7.4
CVE-2026-3876 describes a Stored Cross-Site Scripting (XSS) vulnerability affecting the Prismatic WordPress plugin. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts, potentially leading to account compromise or defacement. The vulnerability impacts versions up to 3.7.3, and a patch is available in version 3.7.4.
An attacker can exploit this XSS vulnerability by injecting malicious JavaScript code within the 'prismatic_encoded' pseudo-shortcode in a comment. When a user views the comment containing the injected script, the script will execute in their browser context. This can allow the attacker to steal cookies, redirect the user to a malicious website, or modify the content of the page. The impact is particularly severe because the vulnerability is stored, meaning the malicious script persists until the comment is removed, affecting all users who view the affected page. Successful exploitation could lead to complete account takeover and further compromise of the WordPress site.
CVE-2026-3876 was publicly disclosed on 2026-04-16. There are currently no known public exploits or active campaigns targeting this vulnerability. The vulnerability is not listed on the CISA KEV catalog at the time of writing. The relatively low CVSS score suggests a moderate exploitation likelihood, but the ease of exploitation via comment injection warrants prompt remediation.
Exploit Status
EPSS
0.02% (6% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2026-3876 is to immediately upgrade the Prismatic WordPress plugin to version 3.7.4 or later. If upgrading is not immediately feasible, consider temporarily disabling the Prismatic plugin to prevent further exploitation. As a short-term workaround, implement strict input validation and output escaping for the 'prismatic_encoded' shortcode within the plugin's code, although this is not a substitute for upgrading. Web Application Firewalls (WAFs) configured to detect and block XSS payloads targeting shortcodes may also provide some protection.
Update to version 3.7.4, or a newer patched version
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-3876 is a Stored XSS vulnerability in the Prismatic WordPress plugin, allowing attackers to inject malicious scripts via the 'prismatic_encoded' shortcode.
You are affected if you are using Prismatic WordPress plugin versions prior to 3.7.4. Check your plugin version and upgrade immediately.
Upgrade the Prismatic WordPress plugin to version 3.7.4 or later. If immediate upgrade is not possible, disable the plugin as a temporary workaround.
There are currently no known active campaigns exploiting CVE-2026-3876, but prompt remediation is still recommended.
Refer to the Prismatic plugin's official website or WordPress plugin repository for the latest advisory and update information.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.