Security Alert Summary
The Astra theme for WordPress contains a stored cross-site scripting (XSS) vulnerability in post meta fields that can be abused by authenticated users with Contributor-level access and above to inject scripts into pages. Injected scripts will execute when a user loads an affected page.
CVE Details
- CVE ID: CVE-2026-3534
- Affected component: Astra theme for WordPress
- Affected versions: All versions up to and including 4.12.3
- Fixed version: Not specified in the CVE entry
- Published: March 11, 2026 at 7:16:45 AM
- Last modified: March 11, 2026 at 1:52:47 PM
- CVSS v3.1: Base Score 6.4, MEDIUM — Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Authentication / privileges / user interaction: Network attack vector; Privileges Required: Low (authenticated user such as Contributor); User Interaction: None; Scope: Changed
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-site Scripting)
Technical Details
The vulnerability is a stored cross-site scripting issue arising from insufficient input sanitization on meta registration and missing output escaping in the astra_get_responsive_background_obj() function. The vulnerable inputs are the post meta fields ast-page-background-meta and ast-content-background-meta. Four CSS-context sub-properties are referenced as lacking proper escaping: background-color, background-image, overlay-color, and overlay-gradient.
Because data from these meta fields can be saved by authenticated users with Contributor-level access and above, an attacker can store arbitrary web scripts in a page’s metadata. The stored script will execute whenever a user (authenticated or unauthenticated, depending on page visibility) loads the affected page, running in the context of that page in the user’s browser.
How This Could Impact Your Website
Consider a small team where a site owner manages the site, internal staff publish content, and an external contractor or contributor is allowed to create or edit pages. If a contributor account is used to insert malicious content into one of the affected meta fields, any user who views that page can execute the injected script. Practical consequences include limited disclosure of information accessible in the browser context (for example, session tokens or profile details), and the potential for targeted social-engineering or credential-theft attempts that leverage information gathered via the injected script.
This vulnerability does not, based on the provided CVSS metrics, imply direct site-wide availability loss, but it does create a pathway for client-side attacks and limited integrity impacts to page content. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected theme as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and other low-privilege accounts that can create or edit content.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained themes and plugins.
- Monitor site activity and page content for unusual or unauthorized changes.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://themes.trac.wordpress.org/browser/astra/4.12.3/inc/core/common-functions.php#L1629
- https://themes.trac.wordpress.org/browser/astra/4.12.3/inc/core/common-functions.php#L1640
- https://themes.trac.wordpress.org/browser/astra/4.12.3/inc/metabox/class-astra-meta-boxes.php#L1380
- https://themes.trac.wordpress.org/browser/astra/4.12.3/inc/metabox/class-astra-meta-boxes.php#L1386
- https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=316958%40astra%2F4.12.4&old=312219%40astra%2F4.12.3
- https://www.wordfence.com/threat-intel/vulnerabilities/id/acf2906b-1ee5-4272-bf6d-36a02023f658?source=cve
