CVE-2026-101928 Overview
CVE-2026-101928 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Magic Tooltips For Contact Form 7 plugin for WordPress. All versions up to and including 1.0.34 are affected. The flaw resides in the handling of the author parameter and allows unauthenticated attackers to inject arbitrary web scripts that execute when administrators or other users view affected pages. The vulnerability stems from insufficient input sanitization combined with an esc_html filter callback that decodes HTML-entity-encoded payloads back into live markup.
Critical Impact
Unauthenticated attackers can submit entity-encoded script payloads as a comment author name. The payloads execute in the browser of any administrator who opens wp-admin/edit-comments.php.
Affected Products
- Magic Tooltips For Contact Form 7 plugin for WordPress
- All versions up to and including 1.0.34
- WordPress sites exposing the plugin's comment author handling
Discovery Timeline
- 2026-10-03 - CVE-2026-101928 published to NVD
- 2026-10-06 - Last updated in NVD database
Technical Details for CVE-2026-101928
Vulnerability Analysis
The plugin registers a filter callback that applies esc_html to content and, in doing so, decodes HTML entities previously stored in the database. An attacker submits a comment containing an entity-encoded payload such as <tip> wrapping a <script> tag in the author field. WordPress's sanitize_text_field strips raw tags but preserves HTML entities, so the encoded payload is written to the database unchanged. When an administrator opens the comments management page, the plugin's filter decodes those entities back into live HTML, and the browser renders the injected markup as executable script.
Root Cause
The root cause is a sanitization and output-escaping mismatch. The plugin's esc_html callback effectively reverses prior encoding by decoding stored HTML entities before output. Combined with sanitize_text_field passing entity-encoded tags through intact, this creates a complete store-and-render path for attacker-controlled script content. The weakness is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.
Attack Vector
Exploitation requires no authentication and no user interaction beyond an administrator viewing comments. An attacker submits a comment to any post that accepts comments on a site running the vulnerable plugin. The author parameter carries the entity-encoded script payload. Once stored, the payload triggers whenever a privileged user loads wp-admin/edit-comments.php, enabling actions in the administrator's session context, including account manipulation and further site compromise.
For technical details on the vulnerable code path, see the WordPress Plugin Hook Script and the Wordfence Vulnerability Report.
Detection Methods for CVE-2026-101928
Indicators of Compromise
- Comment author fields containing HTML entities such as <script, <tip, <, or < encoded tag sequences.
- Unexpected <script> or event-handler attributes rendered inside the WordPress comments admin page.
- Outbound requests from administrator browsers to unfamiliar domains shortly after loading wp-admin/edit-comments.php.
Detection Strategies
- Query the WordPress wp_comments table for comment_author values containing entity-encoded angle brackets or script keywords.
- Monitor web server access logs for POST requests to wp-comments-post.php with suspicious encoded payloads in the author field.
- Inspect browser console errors and Content Security Policy (CSP) violation reports generated when administrators view comment lists.
Monitoring Recommendations
- Enable a web application firewall (WAF) rule set that inspects comment submissions for entity-encoded HTML tag patterns.
- Alert on administrator session activity that originates from unexpected IP addresses following comment moderation sessions.
- Review WordPress plugin inventory for magic-tooltips-for-contact-form-7 at version 1.0.34 or earlier.
How to Mitigate CVE-2026-101928
Immediate Actions Required
- Deactivate the Magic Tooltips For Contact Form 7 plugin on any site running version 1.0.34 or earlier until a patched release is applied.
- Audit existing comments for entity-encoded payloads in the comment_author field and purge any suspicious entries.
- Rotate administrator credentials and invalidate active sessions if XSS indicators are found.
Patch Information
Review the plugin's source control for the fix in the WordPress Changeset Review. Upgrade to the first release published above version 1.0.34 and confirm the esc_html filter callback no longer decodes stored entities before rendering.
Workarounds
- Disable comments site-wide or on posts that are publicly reachable until the plugin is patched.
- Deploy a WAF rule that blocks comment submissions containing entity-encoded tag sequences in the author parameter.
- Enforce a strict Content Security Policy (CSP) that disallows inline script execution in the WordPress admin interface.
# Configuration example: temporarily deactivate the vulnerable plugin via WP-CLI
wp plugin deactivate magic-tooltips-for-contact-form-7
wp plugin status magic-tooltips-for-contact-form-7
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
