CVE-2026-3600

OVERVIEW CVE-2026-3600 is a Stored Cross-Site Scripting vulnerability affecting the Investi WordPress plugin in all versions up to and including 1.0.26. The flaw exists in the 'investi-announcements-accordion' shortcode's 'maximum-num-years' attribute, which fails to properly sanitize and escape user-supplied input before rendering it into HTML attributes. This allows malicious code injection that persists in the database. SEVERITY The vulnerability carries a CVSS score of 6.4 (Medium) and can be exploited over the network with low attack complexity by authenticated attackers with Contributor-level or higher permissions. The attack requires no user interaction beyond accessing an injected page, and the impact includes potential compromise of confidentiality and integrity with cross-site scope. The lack of proper escaping functions (esc_attr(), htmlspecialchars(), etc.) creates a direct pathway for script injection. EXPLOITATION STATUS There is no evidence of active exploitation in the wild, as the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog and remains inactive on threat hot lists. The EPSS score of 0.00013 indicates minimal probability of exploitation. However, the relatively straightforward nature of the vulnerability and the low barrier to entry for authenticated users mean organizations should not delay patching until the plugin is updated beyond version 1.0.26.