Stored Cross-Site Scripting in Investi Plugin for WordPress

CVE-2026-3600

What is CVE-2026-3600?

The Investi plugin for WordPress contains a vulnerability that allows for Stored Cross-Site Scripting (XSS) through the 'investi-announcements-accordion' shortcode. This issue arises from inadequate input sanitation and output escaping when processing user-supplied attributes, specifically the 'maximum-num-years' parameter. Attackers with Contributor-level access and above can exploit this vulnerability by injecting arbitrary scripts into a page, which will execute whenever users access the compromised content. This leaves WordPress sites utilizing the Investi plugin open to potential malicious attacks if not addressed promptly.

References