Security Alert Summary
The Age Verification & Identity Verification by Token of Trust plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability via the 'description' parameter in versions up to and including 3.32.3. Insufficient input sanitization and output escaping allow unauthenticated actors to inject scripts that execute when an affected page is viewed.
CVE Details
- CVE ID: CVE-2026-2834
- Affected component: Age Verification & Identity Verification by Token of Trust plugin for WordPress
- Affected versions: All versions up to, and including, 3.32.3
- Published: April 15, 2026 4:17 AM UTC
- Last modified: April 15, 2026 4:17 AM UTC
- CVSS v3.1: Base Score 7.2, Severity HIGH
- CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Authentication / Privileges / User interaction: Authentication: None required; Privileges required: None; User Interaction: None
- Attack vector / complexity / scope: Network / Low / Changed
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- Weakness (CWE): CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-site Scripting)
Technical Details
According to the advisory, the plugin fails to properly sanitize input and escape output for the 'description' parameter. This allows stored cross-site scripting (XSS): an attacker can submit payloads that are persisted by the plugin and later rendered in pages viewed by users, causing the injected script to execute in the context of those users’ browsers.
The Wordfence report references plugin files in the repository such as admin/error-log.php and admin/settings-page/view-logs.php, which indicate locations where logged or stored content may be output without adequate escaping. The underlying issue is missing or insufficient input validation and output encoding for stored content.
Impact is limited to the effects typical of stored XSS: execution of attacker-controlled scripts in the browsers of users who view the affected pages. The CVSS metrics indicate confidentiality and integrity impacts are rated low and there is no direct availability impact.
How This Could Impact Your Website
Consider a small organization where the site owner manages plugin settings, internal staff post content or logs, and an external contractor occasionally submits form data. If an attacker injects a stored XSS payload into the 'description' field, anyone who views the affected admin or public pages could have scripts run in their browser. Practical consequences include exposure of information visible to the browser (for example, certain profile details or email addresses shown on the page), or the ability to perform actions available to that user within the browser session.
For example, a staff member viewing an injected log or settings page might have session data or form autofill information exposed to the injected script. That data could be used for targeted phishing or social engineering against staff or contractors. The CVSS rating reflects limited confidentiality and integrity impact rather than complete site takeover.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and other low-privilege accounts that can submit content.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior, including unexpected content in admin pages or logs.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/token-of-trust/tags/3.31.4/admin/error-log.php#L4
- https://plugins.trac.wordpress.org/browser/token-of-trust/tags/3.31.4/admin/settings-page/view-logs.php#L13
- https://www.wordfence.com/threat-intel/vulnerabilities/id/2d8e037e-c446-44ae-a5ee-bbba938e5edf?source=cve
