Stored Cross-Site Scripting in Astra Theme for WordPress

CVE-2026-3534

What is CVE-2026-3534?

The Astra theme for WordPress is susceptible to stored cross-site scripting (XSS) through the ast-page-background-meta and ast-content-background-meta post meta fields. This vulnerability arises from inadequate input sanitization during meta registration and a lack of output escaping within the astra_get_responsive_background_obj() function for certain CSS properties, including background-color, background-image, overlay-color, and overlay-gradient. Authenticated users with Contributor-level access or higher can exploit this flaw by injecting malicious web scripts into pages, which will execute whenever a user accesses the compromised content.

References