CVE-2026-1187: ZoomifyWP Free Plugin XSS Vulnerability

CVE-2026-1187 Overview

The ZoomifyWP Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the filename parameter of the zoomify shortcode in all versions up to, and including, 1.1. The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts into pages that will execute whenever a user accesses an injected page.

Critical Impact

Authenticated attackers can persistently inject malicious JavaScript into WordPress pages, potentially compromising site visitors, stealing session cookies, or performing actions on behalf of authenticated users.

Affected Products

• ZoomifyWP Free WordPress Plugin versions up to and including 1.1
• WordPress installations with the ZoomifyWP Free plugin enabled
• Sites allowing Contributor-level or higher user access

Discovery Timeline

• 2026-02-14 - CVE-2026-1187 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-1187

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability exists within the ZoomifyWP Free plugin's shortcode handler. The zoomify shortcode accepts a filename parameter that is not properly sanitized before being rendered in the page output. When a user with Contributor-level privileges or higher creates or edits a post containing the vulnerable shortcode with malicious input, the injected script persists in the database and executes in the browser context of any visitor who views the affected page.

The vulnerability is particularly concerning because it requires only Contributor-level authentication—a relatively low privilege level in WordPress's role hierarchy. Contributors are typically untrusted users who can write posts but cannot publish them directly, making this an attractive vector for insider threats or compromised accounts.

Root Cause

The root cause is insufficient input validation and output escaping (CWE-79) in the shortcode processing function. The filename attribute passed to the zoomify shortcode is not properly sanitized using WordPress security functions such as esc_attr() or wp_kses() before being echoed into the HTML output. This allows an attacker to break out of the expected attribute context and inject arbitrary HTML and JavaScript.

The vulnerable code can be found in the ZoomifyWP Free plugin source at line 54, where the shortcode handler processes user-supplied attributes without adequate escaping.

Attack Vector

The attack is network-based and requires low-privilege authentication (Contributor role or above). An attacker would:

1. Authenticate to the WordPress site with at least Contributor-level access
2. Create or edit a post containing the zoomify shortcode with a malicious filename parameter
3. Include JavaScript payload designed to steal cookies, redirect users, or perform other malicious actions
4. Submit the post for publication (or publish directly if they have higher privileges)
5. The malicious script executes whenever any user views the page containing the compromised shortcode

The attack does not require any user interaction beyond viewing the infected page, and the malicious payload persists until the content is manually cleaned or the plugin is patched.

Detection Methods for CVE-2026-1187

Indicators of Compromise

• Unexpected JavaScript code embedded within post content, particularly within zoomify shortcode parameters
• Unusual filename attribute values containing script tags, event handlers (e.g., onerror, onload), or encoded JavaScript
• Reports from users about unexpected browser behavior, popups, or redirects when viewing specific pages
• Audit log entries showing Contributors creating or modifying posts with zoomify shortcodes

Detection Strategies

• Implement content security monitoring to scan post content for potentially malicious shortcode attribute patterns
• Review WordPress database for wp_posts entries containing zoomify shortcodes with suspicious filename values
• Deploy Web Application Firewall (WAF) rules to detect and block XSS payloads in shortcode parameters
• Enable and regularly review WordPress audit logs for unusual content changes by Contributor-level users

Monitoring Recommendations

• Configure browser Content Security Policy (CSP) headers to mitigate impact of successful XSS exploitation
• Set up alerts for posts containing zoomify shortcodes being created or modified
• Monitor for outbound connections to unknown domains that could indicate data exfiltration
• Implement real-time malware scanning on WordPress content directories

How to Mitigate CVE-2026-1187

Immediate Actions Required

• Update the ZoomifyWP Free plugin to the latest patched version when available
• Audit all existing posts and pages containing the zoomify shortcode for malicious content
• Temporarily disable the ZoomifyWP Free plugin if an update is not yet available
• Review and restrict Contributor-level user accounts, especially those recently added or with suspicious activity

Patch Information

The vulnerability affects ZoomifyWP Free plugin version 1.1 and earlier. Website administrators should check the WordPress Plugin Page for ZoomifyWP Free for the latest security updates. Additional vulnerability details are available from the Wordfence Vulnerability Report.

Workarounds

• Deactivate and remove the ZoomifyWP Free plugin until a security patch is released
• Restrict post creation and editing capabilities for Contributor-level users via role management plugins
• Implement a Web Application Firewall with XSS protection rules to filter malicious input
• Use security plugins like Wordfence to scan and block XSS attempts at the application layer

# Configuration example
# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate tz-zoomifywp-free

# Search for potentially malicious shortcode usage in posts
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%[zoomify%' AND post_content LIKE '%filename=%';"

# Enable maintenance mode while auditing content
wp maintenance-mode activate