CVE-2026-3481

Vulnerability

The WP Blockade plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to and including 0.9.14. The vulnerability resides in the render_shortcode_preview() function, which takes user input from the $_GET['shortcode'] parameter, passes it through stripslashes() without sanitization, and then echoes the result of do_shortcode($shortcode) directly on line 393. When the input is not a valid WordPress shortcode (e.g., an HTML tag with JavaScript event handlers), do_shortcode() returns it unchanged, resulting in unescaped reflection into the page. The endpoint is accessible only to authenticated users via admin_post_ hooks, with no nonce or capability check [1][2].

Exploitation

An attacker must be authenticated with a minimum of Subscriber-level access. The attacker crafts a malicious link containing a shortcode parameter with JavaScript payload (e.g., ``). If a user (such as an administrator) clicks the link, the payload is executed in the context of the victim's browser session against the WordPress admin area. No additional user interaction beyond the click is required.

Impact

Successful exploitation allows the attacker to inject arbitrary web scripts, leading to potential session hijacking, defacement, or theft of sensitive information. The attack runs in the context of the victim's session, which can be used to perform actions on behalf of the victim, including privilege escalation if the victim is an administrator.

Mitigation

Not yet disclosed in the available references. Users of WP Blockade up to version 0.9.14 should restrict access to trusted users and monitor for updates from the plugin author. No patch has been identified as of the publication date.