CVE-2026-3332 Details
Description
The Xhanch - My Advanced Settings plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to missing nonce validation in the `xms_setting()` function on the settings update handler. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Settings that can be modified include favicon URL, Google Analytics account ID, and various WordPress behavior toggles. The `favicon_url` and `ga_acc_id` values are output on the front-end without escaping, enabling a CSRF to Stored XSS chain.
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Xhanch - My Advanced Settings plugin for WordPress, affecting all versions through 1.1.2. The vulnerability arises from a lack of nonce validation in the 'xms_setting()' function, which handles settings updates. This flaw allows unauthenticated attackers to alter plugin settings by sending a forged request, provided they can deceive a site administrator into clicking a link. The settings that can be changed include the favicon URL, Google Analytics account ID, and various WordPress behavior toggles. Notably, the 'favicon_url' and 'ga_acc_id' values are displayed on the front end without proper escaping, creating a potential for a Cross-Site Request Forgery to Stored Cross-Site Scripting (XSS) attack chain.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Mar 21, 2026CISA-ADP
Assessed Mar 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Xhanch - My Advanced Settings | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 21, 2026 | New CVE Received | [email protected] |