Stored Cross-Site Scripting Vulnerability in WM JqMath Plugin for WordPress

CVE-2026-3998

What is CVE-2026-3998?

The WM JqMath plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to inadequate input sanitization and output escaping of user-defined shortcode attributes, specifically the 'style' attribute of the [jqmath] shortcode. This flaw exists in all versions up to and including 1.3, where the generate_jqMathFormula() function fails to apply proper escaping when incorporating the 'style' attribute into HTML. Consequently, authenticated attackers with Contributor-level access can exploit this vulnerability to inject arbitrary scripts into web pages, enabling these scripts to execute in the browser of any user accessing the compromised page. It is crucial for users of this plugin to be aware of this vulnerability and update to patched versions to ensure their websites remain secure.

References