CVE-2026-3332 PUBLISHED

Xhanch - My Advanced Settings <= 1.1.2 - Cross-Site Request Forgery to Settings Update

Assigner: Wordfence
Reserved: 27.02.2026 Published: 21.03.2026 Updated: 21.03.2026

The Xhanch - My Advanced Settings plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to missing nonce validation in the xms_setting() function on the settings update handler. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Settings that can be modified include favicon URL, Google Analytics account ID, and various WordPress behavior toggles. The favicon_url and ga_acc_id values are output on the front-end without escaping, enabling a CSRF to Stored XSS chain.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS Score: 4.3

Product Status

Vendor xhanch_studio
Product Xhanch – My Advanced Settings
Versions Default: unaffected
  • affected from * to 1.1.2 (incl.)

Credits

  • Muhammad Nur Ibnu Hubab finder

References

Problem Types

  • CWE-352 Cross-Site Request Forgery (CSRF) CWE