CVE-2026-0914: WP DSGVO Tools Plugin XSS Vulnerability

CVE-2026-0914 Overview

CVE-2026-0914 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP DSGVO Tools (GDPR) plugin for WordPress, also known as ShapePress DSGVO. The flaw resides in the plugin's lw_content_block shortcode and affects all versions up to and including 3.1.36. The plugin fails to sanitize input and escape output on user-supplied shortcode attributes. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript that executes when any user views the affected page. The vulnerability is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated contributors can persist malicious scripts in WordPress pages, enabling session hijacking, credential theft, and administrative account takeover when privileged users view injected content.

Affected Products

WP DSGVO Tools (GDPR) plugin for WordPress, all versions through 3.1.36
ShapePress DSGVO plugin (alternate name) versions ≤ 3.1.36
WordPress sites with contributor-level or higher user registration enabled

Discovery Timeline

2026-01-23 - CVE-2026-0914 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-0914

Vulnerability Analysis

The WP DSGVO Tools plugin registers a shortcode named lw_content_block to render configurable content blocks within WordPress posts and pages. The shortcode handler accepts user-supplied attributes and writes them into the rendered HTML response without applying input sanitization or context-aware output escaping. Any authenticated user permitted to use shortcodes, including contributors, can embed crafted attribute values that contain JavaScript payloads. When a visitor or administrator loads the page, the browser executes the injected script in the site's origin.

Because the payload is stored in the post content, the attack persists until the page is edited or the plugin is patched. The CVSS vector indicates a scope change, reflecting that script execution in a victim's browser crosses the trust boundary of the vulnerable component.

Root Cause

The root cause is missing input validation and missing output escaping in the shortcode rendering function located in public/shortcodes/content-block-shortcode.php. The plugin concatenates raw shortcode attribute values into HTML output without calling WordPress escaping helpers such as esc_attr() or esc_html(). The upstream fix in WordPress Changeset #3440083 introduces proper escaping on these attributes.

Attack Vector

An attacker first obtains a contributor account, either through registration on sites that allow self-signup or through credential compromise. The attacker then creates or edits a post containing the lw_content_block shortcode with a malicious payload embedded in one of its attributes. After the post is published or previewed by a higher-privileged user, the script executes in that user's authenticated session. Common payload outcomes include exfiltrating session cookies, forging requests against /wp-admin/, creating administrator accounts, and persisting backdoors via plugin or theme edits. See the Wordfence Vulnerability Analysis for additional technical context and the vulnerable source reference.

Detection Methods for CVE-2026-0914

Indicators of Compromise

Post or page content containing [lw_content_block ...] shortcodes with attribute values that include <script>, onerror=, onload=, or javascript: strings.
Unexpected administrator account creation events in wp_users shortly after contributor account activity.
Outbound HTTP requests from administrator browser sessions to unfamiliar domains while editing or previewing posts.
New or modified plugin and theme files following preview activity by privileged users.

Detection Strategies

Query the wp_posts table for post_content entries containing lw_content_block paired with script-related keywords.
Audit WordPress role assignments and recently created contributor accounts for anomalies.
Inspect server access logs for contributor-level requests to post.php and post-new.php followed by privileged user previews.
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution originating from post content.

Monitoring Recommendations

Monitor the WordPress audit log for changes to posts containing the affected shortcode.
Alert on creation of new users with administrator or editor roles outside of normal provisioning windows.
Track plugin version inventory and flag installations of WP DSGVO Tools at or below version 3.1.36.
Review browser console errors and CSP violation reports tied to authenticated admin sessions.

How to Mitigate CVE-2026-0914

Immediate Actions Required

Update the WP DSGVO Tools (GDPR) plugin to a version newer than 3.1.36 that includes the fix from WordPress Changeset #3440083.
Audit all posts and pages for the lw_content_block shortcode and remove any attribute values containing script content.
Review the contributor and author user list and disable or remove accounts that are not required.
Rotate credentials and session tokens for administrators who may have previewed attacker-controlled posts.

Patch Information

The vendor addressed CVE-2026-0914 in the plugin release following 3.1.36, applying proper output escaping in the shortcode handler. The corrective commit is documented in WordPress Changeset #3440083. Site operators should update through the WordPress plugin dashboard or via WP-CLI to receive the fix.

Workarounds

Restrict the contributor role from using the affected shortcode by deactivating WP DSGVO Tools until the patch is applied.
Require administrator approval of all posts authored by contributors before publication or preview.
Enforce a strict Content Security Policy that blocks inline scripts on WordPress front-end and admin pages.
Disable open user registration and remove the default contributor role assignment for new accounts.

bash

# Update the plugin via WP-CLI to receive the patched release
wp plugin update shapepress-dsgvo

# Verify the installed version is greater than 3.1.36
wp plugin get shapepress-dsgvo --field=version

# Search post content for the vulnerable shortcode usage
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%lw_content_block%';"