CVE-2026-3481 is a reflected cross-site scripting vulnerability in the WP Blockade – Visual Page Builder WordPress plugin affecting all versions up to 0.9.14. The vulnerability arises in the render_shortcode_preview() function, which takes user input from the 'shortcode' GET parameter, applies stripslashes() without sanitization, and outputs it via echo do_shortcode($shortcode). If the input is not a valid shortcode, it is returned unchanged and reflected without escaping, enabling script injection. The vulnerable endpoint is accessible only to authenticated users with Subscriber-level privileges or higher, and lacks nonce verification or capability checks, increasing the risk of abuse by authenticated attackers. No known exploits are reported in the wild, and no patch or official remediation is currently documented.

An authenticated attacker with at least Subscriber-level access can inject arbitrary JavaScript code via the 'shortcode' parameter, which is reflected in the page output without proper escaping. This can lead to cross-site scripting attacks that may compromise user sessions or perform actions on behalf of users who click crafted links. The vulnerability does not allow unauthenticated exploitation and does not impact availability. The CVSS score of 6.1 reflects a medium severity impact with low confidentiality and integrity impact and no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level user capabilities if possible and monitor for plugin updates from the vendor. Since the vulnerability requires authenticated access, limiting user roles and educating users about phishing risks can reduce exploitation likelihood. Avoid clicking suspicious links that could trigger the reflected XSS. No nonce or capability checks are present, so additional hardening or custom code to validate inputs may be considered as a temporary mitigation.