CVE-2026-0690: FlatPM WordPress Plugin XSS Vulnerability

CVE-2026-0690 Overview

The FlatPM – Ad Manager, AdSense and Custom Code plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the rank_math_description custom field. All versions up to and including 3.2.2 are affected due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute whenever a user accesses the compromised page.

Critical Impact

Authenticated attackers can inject persistent malicious scripts that execute in the context of any user viewing the affected page, potentially enabling session hijacking, credential theft, or further attacks against site administrators.

Affected Products

• FlatPM – Ad Manager, AdSense and Custom Code plugin for WordPress versions up to and including 3.2.2
• WordPress installations utilizing the vulnerable FlatPM plugin
• Sites with contributor-level or higher user accounts that could be compromised

Discovery Timeline

• January 20, 2026 - CVE CVE-2026-0690 published to NVD
• January 20, 2026 - Last updated in NVD database

Technical Details for CVE-2026-0690

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The flaw exists in how the FlatPM plugin processes and renders the rank_math_description custom field content. When user-supplied data is stored in this field, the plugin fails to properly sanitize input on storage and escape output during rendering, creating an injection point for malicious scripts.

The stored nature of this XSS vulnerability makes it particularly dangerous compared to reflected XSS variants. Once a malicious script is injected, it persists in the WordPress database and executes automatically for every user who views the affected page, without requiring additional user interaction beyond page access.

Root Cause

The root cause is insufficient input sanitization and output escaping within the FlatPM plugin's handling of the rank_math_description custom field. WordPress provides built-in functions like sanitize_text_field(), esc_html(), and wp_kses() for proper input/output handling, but the vulnerable code path fails to implement these safeguards adequately. This allows HTML and JavaScript content to be stored and rendered without neutralization.

Attack Vector

The attack requires authenticated access with at least contributor-level privileges, which is a common role in multi-author WordPress sites. An attacker can craft malicious content containing JavaScript payloads and submit it through the rank_math_description custom field interface. The network-accessible attack vector with low complexity means exploitation is straightforward once authentication requirements are met.

The malicious script could be designed to steal session cookies, redirect users to phishing pages, modify page content, or perform actions on behalf of authenticated administrators viewing the page. The changed scope indicated in the vulnerability assessment means the attack can impact resources beyond the vulnerable component's security scope.

Detection Methods for CVE-2026-0690

Indicators of Compromise

• Unexpected JavaScript code or encoded script tags in rank_math_description custom field values in the WordPress database
• Anomalous wp_postmeta table entries containing <script> tags, event handlers (onclick, onerror, onload), or JavaScript URIs
• User reports of unexpected browser behavior, redirects, or pop-ups when viewing specific pages
• Authentication logs showing unusual admin-level activity following page views by administrators

Detection Strategies

• Implement database monitoring to detect HTML/JavaScript content in custom field values that should contain plain text
• Deploy Web Application Firewall (WAF) rules to identify XSS patterns in POST requests to WordPress admin endpoints
• Enable WordPress audit logging to track custom field modifications by contributor-level users
• Use security plugins capable of scanning post metadata for malicious content patterns

Monitoring Recommendations

• Monitor the wp_postmeta table for entries with meta_key matching rank_math_description containing suspicious content
• Set up alerts for contributor-level users modifying SEO-related custom fields
• Review access logs for pages that receive unusually high traffic or generate external requests to unknown domains
• Implement Content Security Policy (CSP) headers to mitigate script execution even if injection occurs

How to Mitigate CVE-2026-0690

Immediate Actions Required

• Update the FlatPM plugin to the patched version immediately by accessing the WordPress Plugin Change Log
• Audit all existing rank_math_description custom field entries in the database for malicious content
• Review and potentially revoke contributor-level access for untrusted users until the patch is applied
• Enable a Web Application Firewall with XSS protection rules as an additional defense layer

Patch Information

A security patch addressing this vulnerability has been released. The fix can be reviewed in the WordPress Plugin Change Log. Organizations should update to a version newer than 3.2.2 to remediate this vulnerability. Additional technical details are available in the Wordfence Vulnerability Report.

Workarounds

• Restrict contributor-level access to trusted users only until the plugin can be updated
• Implement database-level triggers or application logic to sanitize the rank_math_description field content
• Deploy Content Security Policy headers to prevent inline script execution as a defense-in-depth measure
• Consider temporarily disabling the FlatPM plugin if it is not critical to site operations

# Database query to identify potentially malicious entries
# Run in WordPress database to audit rank_math_description fields
SELECT post_id, meta_value 
FROM wp_postmeta 
WHERE meta_key = 'rank_math_description' 
AND (meta_value LIKE '%<script%' 
     OR meta_value LIKE '%javascript:%' 
     OR meta_value LIKE '%onerror=%' 
     OR meta_value LIKE '%onclick=%');