CVE-2026-3998

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

The WM JqMath plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style' shortcode attribute of the [jqmath] shortcode in all versions up to and including 1.3. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. The generate_jqMathFormula() function directly concatenates the 'style' attribute value into an HTML style attribute without applying esc_attr() or any other escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
webmindpt	WM JqMath	<= 1.3

References

Timeline

Published: Apr 15, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-399807.2OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.5, the safeEjs.ts file doe CVE-2026-399818.8AGiXT is a dynamic AI Agent Automation Platform. Prior to 1.9.2, the safe_join() function in the essential_abilities extension fails to vali CVE-2026-399838.6basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows FTP command injection via CRLF sequences (\r\n) in file path parame CVE-2026-399845.5Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Versions 2.0.5 and below contain an authorization bypass vulnerab CVE-2026-399856.1LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neur CVE-2026-399879.8marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws CVE-2026-399895.3A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, CVE-2026-39998.8A broken access control may allow an authenticated user to perform a horizontal privilege escalation. The vulnerability only impacts specif CVE-2026-399914.8A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can CVE-2026-399938.7A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can th CVE-2026-399978.9A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability CVE-2026-399988.8Improper Input Validation vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin t