CVE-2026-3998

The WM JqMath plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style' shortcode attribute of the [jqmath] shortcode in all versions up to and including 1.3. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. The generate_jqMathFormula() function directly concatenates the 'style' attribute value into an HTML style attribute without applying esc_attr() or any other escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• CWE-79

• https://plugins.trac.wordpress.org/browser/wm-jqmath/tags/1.3/wm_jqmath.php#L27
• https://plugins.trac.wordpress.org/browser/wm-jqmath/tags/1.3/wm_jqmath.php#L33
• https://plugins.trac.wordpress.org/browser/wm-jqmath/trunk/wm_jqmath.php#L27
• https://plugins.trac.wordpress.org/browser/wm-jqmath/trunk/wm_jqmath.php#L33
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b4aebb45-b47b-4b5a-8281-400a4b786689?source=cve

Published

Apr 15, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-39972Mercure is a protocol for pushing data updates to web browse…7.1
• CVE-2026-39973Apktool is a tool for reverse engineering Android APK files.…7.1
• CVE-2026-39974n8n-MCP is a Model Context Protocol (MCP) server that provid…8.5
• CVE-2026-39976Laravel Passport provides OAuth2 server support to Laravel. …7.1
• CVE-2026-39977flatpak-builder is a tool to build flatpaks from source. Fro…6.3
• CVE-2026-39979jq is a command-line JSON processor. In commits before 2f090…6.5
• CVE-2026-39980OpenCTI is an open source platform for managing cyber threat…7.2
• CVE-2026-39981AGiXT is a dynamic AI Agent Automation Platform. Prior to 1.…8.8
• CVE-2026-39983basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basi…8.6
• CVE-2026-39984Sigstore Timestamp Authority is a service for issuing RFC 31…5.5
• CVE-2026-39985LORIS (Longitudinal Online Research and Imaging System) is a…6.1
• CVE-2026-39987marimo is a reactive Python notebook. Prior to 0.23.0, Marim…9.8