CVE-2021-47982: WP-Paginate Plugin Stored XSS Vulnerability

CVE-2021-47982 Overview

CVE-2021-47982 is a stored cross-site scripting [CWE-79] vulnerability in the WordPress plugin WP-Paginate version 2.1.3. The flaw resides in the handling of the preset parameter on the plugin settings page. Authenticated attackers can submit a POST request containing script payloads in the preset parameter. The plugin stores the payload without sanitization and renders it when administrators view the settings page. Execution occurs in the administrator browser context, enabling session theft, privileged action abuse, and account takeover within the WordPress installation.

Critical Impact
Authenticated attackers can persist JavaScript in plugin settings that executes in an administrator session, enabling account takeover of the WordPress site.

Affected Products

WordPress Plugin WP-Paginate version 2.1.3
WordPress sites with WP-Paginate installed and active
Administrators accessing the plugin settings page in affected versions

Discovery Timeline

2026-06-08 - CVE-2021-47982 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2021-47982

Vulnerability Analysis

The vulnerability is a stored cross-site scripting issue in the WP-Paginate plugin settings handler. The plugin accepts the preset parameter from POST submissions to its settings page without applying output encoding or input sanitization. The submitted value persists in the WordPress options table. When an administrator loads the settings page, the stored value is rendered into the response HTML, where the browser parses and executes any embedded JavaScript.

Exploitation requires an authenticated session with privileges to access the plugin configuration endpoint. Successful execution runs attacker-controlled JavaScript with the privileges of the viewing administrator. Attackers can use this access to create new administrative accounts, modify content, exfiltrate session cookies, or pivot to additional WordPress components.

The EPSS score is 0.029%, reflecting limited observed exploitation activity. A public proof of concept is published as Exploit-DB #49355, and additional technical context is available in the VulnCheck Advisory on XSS.

Root Cause

The plugin fails to sanitize the preset POST parameter before storing it and fails to escape it on output. Neither sanitize_text_field() on input nor esc_attr()/esc_html() on output is applied, allowing raw HTML and script tags to reach the rendered DOM.

Attack Vector

The attack vector is network-based and requires an authenticated user. The attacker submits a crafted POST request to the WP-Paginate settings endpoint with a JavaScript payload in the preset parameter. Execution is triggered when a privileged user subsequently browses the settings page.

No verified sanitized exploitation code is provided. Refer to the Exploit-DB #49355 entry for the public proof of concept.

Detection Methods for CVE-2021-47982

Indicators of Compromise

POST requests to the WP-Paginate settings endpoint containing <script>, onerror=, or javascript: substrings in the preset parameter
Unexpected new administrator accounts or modified user roles in wp_users following plugin configuration changes
Outbound requests from administrator browsers to unfamiliar domains shortly after visiting the plugin settings page
WordPress option rows under WP-Paginate keys containing HTML or script content

Detection Strategies

Inspect HTTP request bodies to wp-admin/options-general.php and plugin-specific endpoints for script syntax in form fields
Query the wp_options table for WP-Paginate entries and alert on values containing <script, onerror, onload, or encoded JavaScript
Correlate authenticated WordPress session activity with subsequent administrator session anomalies such as new role changes or plugin installs

Monitoring Recommendations

Forward WordPress access logs and application audit logs to a centralized analytics platform for query and alerting
Monitor changes to plugin option values and trigger review when persisted fields contain HTML markup
Track administrator browser activity for outbound connections to domains not previously seen during sessions on the WordPress admin interface

How to Mitigate CVE-2021-47982

Immediate Actions Required

Audit WordPress installations for the WP-Paginate plugin at version 2.1.3 and disable it where present until remediation is verified
Review the wp_options table for WP-Paginate entries and remove any values containing HTML or script content
Rotate administrator credentials and invalidate active sessions if exploitation is suspected
Review recent administrator account creations and role modifications for unauthorized changes

Patch Information

No vendor patch reference is included in the available data. Consult the WordPress Plugin Information page for the latest available version and apply updates that address the stored XSS in the preset parameter. If no fixed release is available, remove the plugin and select an alternative.

Workarounds

Restrict access to the plugin settings page using WordPress role management or a web application firewall rule that limits the endpoint to specific administrator IPs
Deploy a WAF signature that blocks POST requests containing script tags or JavaScript event handlers in the preset parameter
Apply a Content Security Policy that disallows inline script execution in the WordPress admin interface to reduce exploitation impact

bash

# Configuration example: WAF rule blocking script payloads in the preset parameter
# ModSecurity rule
SecRule ARGS:preset "@rx (?i)(<script|onerror=|onload=|javascript:)" \
  "id:1004798,phase:2,deny,status:403,msg:'WP-Paginate preset XSS attempt (CVE-2021-47982)'"