CVE-2026-1047: WordPress Salavat Counter XSS Vulnerability

CVE-2026-1047 Overview

The salavat counter Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the image_url parameter in all versions up to, and including, 0.9.5. This vulnerability arises from insufficient input sanitization and output escaping, allowing authenticated attackers with administrator-level access to inject arbitrary web scripts into pages. These malicious scripts execute whenever any user accesses the injected page.

Critical Impact

Authenticated administrators can inject persistent malicious JavaScript that executes in the context of other users' sessions, potentially leading to session hijacking, credential theft, or malicious redirects.

Affected Products

• salavat counter Plugin for WordPress versions up to and including 0.9.5
• WordPress installations using the vulnerable plugin versions
• Multi-site WordPress environments with the plugin activated

Discovery Timeline

• 2026-02-19 - CVE-2026-1047 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-1047

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability exists in the salavat counter Plugin's handling of the image_url parameter within the wp-table-options.php file. The plugin fails to properly sanitize user-supplied input and escape output when rendering the image URL value, creating an injection point for malicious scripts.

The attack requires administrator-level authentication, which limits the initial attack surface. However, in environments where multiple administrators exist or where administrator credentials may be compromised, this vulnerability poses a significant risk. Once injected, the malicious script persists in the database and executes for all users who view the affected page, including other administrators.

The network-based attack vector combined with the scope change characteristic means that while the attacker needs high privileges, the impact can extend beyond the vulnerable component to affect other users' browser sessions.

Root Cause

The vulnerability stems from improper input validation in the plugin's options handling code. Specifically, at line 352 in wp-table-options.php, the image_url parameter is processed without adequate sanitization using WordPress security functions like esc_url() or esc_attr(). When this unsanitized value is subsequently rendered in the HTML output, it allows attackers to break out of the expected context and inject script tags or event handlers.

Attack Vector

The attack is network-based and requires the attacker to have authenticated access with administrator privileges on the target WordPress installation. The attacker navigates to the plugin's settings page and submits a crafted payload in the image_url field. Since there is no user interaction required for the script to execute once stored, the attacker simply needs to inject the payload once, and it will persistently affect any user visiting the page containing the counter widget.

The stored nature of this XSS means the malicious payload becomes part of the page content, making it more dangerous than reflected XSS variants as it affects multiple victims without requiring social engineering for each target.

Detection Methods for CVE-2026-1047

Indicators of Compromise

• Unexpected JavaScript code or event handlers in the image_url configuration values stored in the WordPress options table
• Anomalous <script> tags or JavaScript event handlers (e.g., onerror, onload) in page source where the salavat counter is displayed
• Browser security warnings or Content Security Policy violations related to inline script execution on pages containing the counter widget

Detection Strategies

• Review WordPress options table entries for the salavat counter plugin configuration, searching for suspicious patterns like <script>, javascript:, or HTML event attributes
• Implement Web Application Firewall (WAF) rules to detect XSS patterns in POST requests to WordPress admin endpoints
• Enable and monitor browser Content Security Policy headers for violation reports indicating attempted inline script execution

Monitoring Recommendations

• Configure logging for all administrative changes to plugin settings in WordPress audit logs
• Deploy endpoint detection solutions capable of identifying XSS payload patterns in web traffic
• Regularly scan plugin configuration values for malicious content using automated security tools

How to Mitigate CVE-2026-1047

Immediate Actions Required

• Review all current settings in the salavat counter Plugin for suspicious JavaScript or HTML content in the image_url field
• Consider temporarily deactivating the salavat counter Plugin until a patched version is available
• Implement Content Security Policy headers to restrict inline script execution as a defense-in-depth measure
• Audit administrator accounts and ensure only trusted users have administrative access

Patch Information

At the time of publication, users should check the WordPress Plugin Information Page for updated versions that address this vulnerability. The latest plugin version can be downloaded from the WordPress Plugin Download page. Additionally, the Wordfence Vulnerability Report provides ongoing updates regarding patch availability and additional mitigation guidance.

Workarounds

• Restrict administrator access to only essential trusted personnel until a patch is available
• Implement a Web Application Firewall with XSS protection rules to filter malicious input
• Add Content Security Policy headers (script-src 'self') to prevent execution of injected inline scripts
• Consider using a security plugin to monitor and sanitize plugin configuration values

# Example Content Security Policy header configuration for Apache
# Add to .htaccess or virtual host configuration
Header set Content-Security-Policy "script-src 'self'; object-src 'none';"