Stored Cross-Site Scripting Vulnerability in Injection Guard Plugin for WordPress

CVE-2026-3368

What is CVE-2026-3368?

The Injection Guard plugin for WordPress is vulnerable to stored cross-site scripting due to inadequate input sanitization in the sanitize_ig_data() function. This vulnerability allows malicious query parameter names to bypass security checks, allowing attackers to inject arbitrary scripts into the admin log page. When an administrator views the log, these scripts execute, potentially leading to unauthorized actions and data breaches. The vulnerability arises from the improper handling of array keys, which are stored and rendered without sufficient escaping measures, exposing the plugin to exploitation.

References