CVE-2026-3362 is a stored cross-site scripting vulnerability in the itsananderson Short Comment Filter WordPress plugin, affecting all versions up to 2.2. The issue arises from lack of sanitization on the 'Minimum Count' settings field and absence of escaping when rendering the stored option value in an HTML attribute context. Authenticated users with administrator privileges can exploit this to inject malicious scripts into the settings page, which execute upon page access. This vulnerability is more impactful in multisite environments or when DISALLOW_UNFILTERED_HTML is set, limiting administrators' capabilities.

An authenticated attacker with administrator-level access can inject and execute arbitrary JavaScript in the plugin's settings page. This could lead to session hijacking, privilege escalation, or other attacks against users accessing that page. The vulnerability does not affect unauthenticated users and requires high privileges to exploit. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and monitor for suspicious activity. Avoid using the affected plugin version in high-risk environments, especially multisite installations or where unfiltered HTML capabilities are restricted.