CVE-2026-3512 is a reflected XSS vulnerability in the Writeprint Stylometry WordPress plugin (version 0 and earlier). The issue arises from insufficient input sanitization and output escaping of the 'p' GET parameter in the bjl_wprintstylo_comments_nav() function. This parameter is directly embedded into an HTML href attribute, enabling authenticated attackers with Contributor or higher privileges to inject arbitrary JavaScript code. Successful exploitation requires social engineering to trick other users into clicking a malicious link, potentially leading to script execution in their browsers.

An attacker with Contributor-level or higher permissions can inject malicious scripts that execute in the context of other users' browsers when they click a crafted link containing the vulnerable 'p' parameter. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed on behalf of the victim user. The vulnerability does not affect availability. There are no known exploits in the wild at this time.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is released, restrict Contributor-level permissions to trusted users only and educate users to avoid clicking suspicious links. Consider applying manual input sanitization or output escaping as a temporary mitigation if feasible.