CVE-2026-3534

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3534", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-03-04T17:29:25.810Z", "datePublished": "2026-03-11T06:45:31.218Z", "dateUpdated": "2026-04-08T17:14:59.550Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:14:59.550Z"}, "affected": [{"vendor": "brainstormforce", "product": "Astra", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.12.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Astra theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `ast-page-background-meta` and `ast-content-background-meta` post meta fields in all versions up to, and including, 4.12.3. This is due to insufficient input sanitization on meta registration and missing output escaping in the `astra_get_responsive_background_obj()` function for four CSS-context sub-properties (`background-color`, `background-image`, `overlay-color`, `overlay-gradient`). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Astra <= 4.12.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/acf2906b-1ee5-4272-bf6d-36a02023f658?source=cve"}, {"url": "https://themes.trac.wordpress.org/browser/astra/4.12.3/inc/core/common-functions.php#L1640"}, {"url": "https://themes.trac.wordpress.org/browser/astra/4.12.3/inc/core/common-functions.php#L1629"}, {"url": "https://themes.trac.wordpress.org/browser/astra/4.12.3/inc/metabox/class-astra-meta-boxes.php#L1386"}, {"url": "https://themes.trac.wordpress.org/browser/astra/4.12.3/inc/metabox/class-astra-meta-boxes.php#L1380"}, {"url": "https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=316958%40astra%2F4.12.4&old=312219%40astra%2F4.12.3"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Alex Hickey"}], "timeline": [{"time": "2026-03-04T17:45:12.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-03-10T17:27:37.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-11T14:00:26.814244Z", "id": "CVE-2026-3534", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T14:00:35.014Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3534", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-11T14:00:26.814244Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T14:00:31.843Z"}}], "cna": {"title": "Astra <= 4.12.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta", "credits": [{"lang": "en", "type": "finder", "value": "Alex Hickey"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "brainstormforce", "product": "Astra", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.12.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-03-04T17:45:12.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-03-10T17:27:37.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/acf2906b-1ee5-4272-bf6d-36a02023f658?source=cve"}, {"url": "https://themes.trac.wordpress.org/browser/astra/4.12.3/inc/core/common-functions.php#L1640"}, {"url": "https://themes.trac.wordpress.org/browser/astra/4.12.3/inc/core/common-functions.php#L1629"}, {"url": "https://themes.trac.wordpress.org/browser/astra/4.12.3/inc/metabox/class-astra-meta-boxes.php#L1386"}, {"url": "https://themes.trac.wordpress.org/browser/astra/4.12.3/inc/metabox/class-astra-meta-boxes.php#L1380"}, {"url": "https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=316958%40astra%2F4.12.4&old=312219%40astra%2F4.12.3"}], "descriptions": [{"lang": "en", "value": "The Astra theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `ast-page-background-meta` and `ast-content-background-meta` post meta fields in all versions up to, and including, 4.12.3. This is due to insufficient input sanitization on meta registration and missing output escaping in the `astra_get_responsive_background_obj()` function for four CSS-context sub-properties (`background-color`, `background-image`, `overlay-color`, `overlay-gradient`). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:14:59.550Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3534", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:14:59.550Z", "dateReserved": "2026-03-04T17:29:25.810Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-11T06:45:31.218Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Astra", "vendor": "brainstormforce", "versions": [{"lessThanOrEqual": "4.12.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Astra theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `ast-page-background-meta` and `ast-content-background-meta` post meta fields in all versions up to, and including, 4.12.3. This is due to insufficient input sanitization on meta registration and missing output escaping in the `astra_get_responsive_background_obj()` function for four CSS-context sub-properties (`background-color`, `background-image`, `overlay-color`, `overlay-gradient`). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El tema Astra para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s de los campos de metadatos de publicaci\u00f3n 'ast-page-background-meta' y 'ast-content-background-meta' en todas las versiones hasta la 4.12.3, inclusive. Esto se debe a una sanitizaci\u00f3n de entrada insuficiente en el registro de metadatos y a una falta de escape de salida en la funci\u00f3n 'astra_get_responsive_background_obj()' para cuatro subpropiedades de contexto CSS ('background-color', 'background-image', 'overlay-color', 'overlay-gradient'). Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2026-3534", "lastModified": "2026-06-17T10:43:44.243", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3534", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-11T14:00:26.814244Z", "version": "2.0.3"}}]}, "published": "2026-03-11T07:16:45.213", "references": [{"source": "security@wordfence.com", "url": "https://themes.trac.wordpress.org/browser/astra/4.12.3/inc/core/common-functions.php#L1629"}, {"source": "security@wordfence.com", "url": "https://themes.trac.wordpress.org/browser/astra/4.12.3/inc/core/common-functions.php#L1640"}, {"source": "security@wordfence.com", "url": "https://themes.trac.wordpress.org/browser/astra/4.12.3/inc/metabox/class-astra-meta-boxes.php#L1380"}, {"source": "security@wordfence.com", "url": "https://themes.trac.wordpress.org/browser/astra/4.12.3/inc/metabox/class-astra-meta-boxes.php#L1386"}, {"source": "security@wordfence.com", "url": "https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=316958%40astra%2F4.12.4&old=312219%40astra%2F4.12.3"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/acf2906b-1ee5-4272-bf6d-36a02023f658?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.12.3]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Astra", "source": "cna", "vendor": "brainstormforce"}, "product": "astra", "vendor": "brainstormforce"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-17T17:24:42.165228+00:00", "value": {"mitigation_remediation": ["Backup your WordPress site and database", "Check for and install the latest Astra theme version if available (greater than 4.12.3)", "If an upgrade is not possible, remove or sanitize the `ast-page-background-meta` and `ast-content-background-meta` fields from user\u2011editable content", "Consider restricting Contributor users from editing post meta fields that influence background styling", "Deploy a site\u2011wide content filtering plugin that sanitizes post meta before rendering"], "summary": {"action": "Patch Now", "impact": "Stored Cross\u2011Site Scripting (XSS)"}, "threat_synthesis": {"affected_systems": "All installations of WordPress that use the Astra theme and run any version through and including 4.12.3 are susceptible, as the vulnerability exists in every build up to that point. The description specifically notes that the issue is present in \"all versions up to, and including, 4.12.3\".\n", "description_and_impact": "Key detail from vendor description: The Astra theme includes a stored cross\u2011site scripting flaw in the `ast-page-background-meta` and `ast-content-background-meta` post meta fields. The flaw arises from insufficient input sanitization during meta registration and from missing output escaping when rendering four CSS\u2011context sub\u2011properties -- background-color, background-image, overlay-color, and overlay-gradient. As a result, an attacker who can edit these fields can inject arbitrary JavaScript. The injected script executes whenever any visitor loads an affected page, enabling actions such as session hijacking, defacement, or other malicious behaviors. The weakness is identified as CWE\u201179.\n", "risk_and_exploitability": "The CVSS score of 6.4 classifies this issue as medium severity. An EPSS score of less than 1% suggests a low likelihood of exploitation in the wild; it is not listed in the CISA KEV catalog. Attackers must first be authenticated with Contributor-level privileges or higher, a role commonly available on multi\u2011user WordPress sites. Because the vulnerability is stored in post meta, the impact once a payload is injected affects all subsequent users who view the page, leading to potentially wide\u2011scale compromise of confidentiality, integrity, and availability for site visitors."}}}}, "created": "2026-03-12T10:06:18.890058+00:00", "updated": "2026-03-20T14:37:39.935105+00:00", "vendors": ["brainstormforce", "brainstormforce$PRODUCT$astra", "wordpress", "wordpress$PRODUCT$wordpress"]}