CVE-2026-3534

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

The Astra theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `ast-page-background-meta` and `ast-content-background-meta` post meta fields in all versions up to, and including, 4.12.3. This is due to insufficient input sanitization on meta registration and missing output escaping in the `astra_get_responsive_background_obj()` function for four CSS-context sub-properties (`background-color`, `background-image`, `overlay-color`, `overlay-gradient`). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Mar 11, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-353405.5A flaw in the ChownExecutor used by uutils coreutils chown and chgrp causes the utilities to return an incorrect exit code during recursive CVE-2026-353417.1A vulnerability in uutils coreutils mkfifo allows for the unauthorized modification of permissions on existing files. When mkfifo fails to cCVE-2026-353423.3The mktemp utility in uutils coreutils fails to properly handle an empty TMPDIR environment variable. Unlike GNU mktemp, which falls back toCVE-2026-353433.3The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiteCVE-2026-353443.3The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result::ok() on truncationCVE-2026-353455.3A vulnerability in the tail utility of uutils coreutils allows for the exfiltration of sensitive file contents when using the --follow=name CVE-2026-353463.3The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines. The implementation useCVE-2026-353474.4The comm utility in uutils coreutils incorrectly consumes data from non-regular file inputs before performing comparison operations. The areCVE-2026-353485.5The sort utility in uutils coreutils is vulnerable to a process panic when using the --files0-from option with inputs containing non-UTF-8 fCVE-2026-353497.7A vulnerability in the rm utility of uutils coreutils allows a bypass of the --preserve-root protection. The implementation uses a path-striCVE-2026-35359.8The DSGVO Google Web Fonts GDPR plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the `DSGVCVE-2026-353506.6The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the