CVE-2026-3534: 
WordPress vulnerability analysis and mitigation

CVE-2026-3534 is a Stored Cross-Site Scripting (XSS) vulnerability in the Astra theme for WordPress, affecting all versions up to and including 4.12.3. The flaw exists in the ast-page-background-meta and ast-content-background-meta post meta fields, allowing authenticated attackers with Contributor-level access or above to inject arbitrary web scripts into pages. The vulnerability was published on March 11, 2026, and was assigned by Wordfence. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, ENISA EUVD).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). Specifically, the vulnerability stems from two compounding weaknesses: insufficient input sanitization during meta field registration (in class-astra-meta-boxes.php at lines 1380 and 1386) and missing output escaping in the astra_get_responsive_background_obj() function (in common-functions.php at lines 1629 and 1640) for four CSS-context sub-properties: background-color, background-image, overlay-color, and overlay-gradient. An authenticated attacker with at least Contributor access can craft a malicious post that stores a JavaScript payload in these meta fields, which then executes in the browser of any user who visits the affected page (Wordfence, Astra Trac).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of any user's browser session when they visit an injected page, impacting both confidentiality and integrity (CVSS C:L/I:L/A:N). This could lead to session cookie theft, credential harvesting, defacement of page content, or redirection to malicious sites. Because the payload is stored server-side and executes for all visitors, the blast radius extends to all site users — including administrators — who view the compromised page (Wordfence, ENISA EUVD).

No public exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.036%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the Contributor level or above, which limits opportunistic attack surface but remains a realistic threat on multi-author WordPress sites (Wordfence, ENISA EUVD).

1. Reconnaissance: Identify WordPress sites using the Astra theme at version 4.12.3 or earlier (e.g., via HTTP response headers, page source, or tools like WPScan).
2. Obtain Contributor access: Register or compromise an account with at least Contributor-level privileges on the target WordPress site.
3. Create or edit a post/page: Navigate to the WordPress editor and create or edit a post or page where the Astra theme's background meta fields are accessible.
4. Inject malicious payload: Insert a crafted JavaScript payload into the ast-page-background-meta or ast-content-background-meta post meta fields — for example, targeting the background-image or overlay-color sub-properties with a value such as url('javascript:alert(document.cookie)') or a CSS injection that breaks context and introduces a <script> tag.
5. Publish the page: Submit or update the post/page so the malicious meta value is stored in the WordPress database.
6. Trigger execution: Any user (including administrators) who visits the injected page will have the malicious script execute in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, Astra Trac).

• Logs: WordPress database or audit logs showing unexpected updates to ast-page-background-meta or ast-content-background-meta post meta fields, particularly containing JavaScript, <script> tags, or unusual CSS values (e.g., url(javascript:...)).
• File System: No direct file-system artifacts expected, as the payload is stored in the WordPress database (wp_postmeta table); forensic review of the meta_value column for these meta keys is recommended.
• Network: Outbound requests from victim browsers to attacker-controlled domains following page visits; unusual JavaScript-initiated HTTP requests in web server or proxy logs.
• Process/Application: Unexpected admin account creation, password reset requests, or privilege escalation events in WordPress activity logs shortly after a Contributor-level user edited a page with Astra background meta fields.

Brainstorm Force released a patched version of the Astra theme (4.12.4) that addresses this vulnerability by adding proper input sanitization and output escaping. Site administrators should update the Astra theme to version 4.12.4 or later immediately via the WordPress dashboard or the WordPress theme repository. As a temporary measure, restricting Contributor-level user registration or limiting post/page editing permissions can reduce exposure until the update is applied (Wordfence, Astra Changeset).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability report for March 9–15, 2026, and published a dedicated threat intelligence entry. The vulnerability was also noted in the ENISA European Vulnerability Database (EUVD-2026-11111). Community aggregators including CVEFeed, VulDB, and Bluesky CVE tracking accounts picked up the disclosure shortly after publication, reflecting routine community monitoring of WordPress theme vulnerabilities (Wordfence Blog, ENISA EUVD).