CVE-2026-1189: LeadBI Plugin for WordPress XSS Flaw

CVE-2026-1189 Overview

CVE-2026-1189 is a Stored Cross-Site Scripting (XSS) vulnerability in the LeadBI Plugin for WordPress. The flaw affects all versions up to and including 1.7. It originates from the form_id parameter of the leadbi_form shortcode, where user-supplied attributes are not properly sanitized or escaped on output. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript into pages. The injected script executes in the browser of any visitor who accesses the affected page, enabling session theft, redirection, and unauthorized actions in the victim's session context.

Critical Impact
Authenticated contributors can persistently inject JavaScript that executes against any visitor, including administrators, leading to potential account takeover and site compromise.

Affected Products

LeadBI Plugin for WordPress — all versions up to and including 1.7
WordPress sites running the vulnerable plugin with Contributor or higher user roles enabled
Any page or post embedding the leadbi_form shortcode

Discovery Timeline

2026-01-24 - CVE-2026-1189 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-1189

Vulnerability Analysis

The vulnerability is classified as Cross-Site Scripting [CWE-79]. The LeadBI plugin registers the leadbi_form shortcode and accepts a form_id attribute supplied by post authors. The plugin reflects this attribute back into rendered HTML without applying WordPress escaping functions such as esc_attr() or esc_html(). As a result, a Contributor can craft a post containing a shortcode whose form_id value carries an HTML-breaking payload. When the post is previewed or published and an editor or visitor loads the page, the browser parses the injected markup and executes the attacker-controlled JavaScript.

Because the scope changes from the contributing user to the viewing administrator, the attack can pivot from a low-privilege account to full site control through nonce theft or REST API abuse from the victim's session.

Root Cause

The root cause is insufficient input sanitization and missing output escaping on shortcode attributes within the plugin's shortcode handler defined in includes/Plugin.php. User-supplied values flow into HTML output without being filtered through WordPress's context-appropriate escaping APIs.

Attack Vector

Exploitation is performed over the network by an authenticated user. The attacker creates or edits a post that includes the leadbi_form shortcode with a malicious form_id value containing HTML attribute-breaking characters and a JavaScript payload. After the post is submitted for review or published, the payload is stored in the database. Every subsequent rendering of the page triggers script execution in the visiting user's browser. No additional user interaction is required beyond visiting the affected page.

For technical context, see the WordPress Plugin Source Code and the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2026-1189

Indicators of Compromise

Posts or pages containing the [leadbi_form] shortcode with form_id values that include <, >, ", ', or javascript: substrings
Unexpected <script> tags, on* event handlers, or external script src references rendered inside form markup
Outbound browser requests from administrator sessions to attacker-controlled domains shortly after viewing posts authored by Contributors
New administrator accounts or modified user roles created in proximity to Contributor post submissions

Detection Strategies

Query the WordPress wp_posts table for post_content entries matching leadbi_form combined with suspicious characters in shortcode attributes
Review WordPress audit logs for posts authored by Contributor-level accounts that contain shortcodes
Inspect rendered HTML of pages embedding the leadbi_form shortcode for unescaped attribute boundaries

Monitoring Recommendations

Monitor browser-side telemetry and Content Security Policy (CSP) violation reports for inline script execution on pages using the plugin
Track HTTP requests to /wp-admin/post.php and /wp-admin/post-new.php originating from low-privilege accounts
Alert on creation of administrator accounts or privilege changes following content edits by Contributor users

How to Mitigate CVE-2026-1189

Immediate Actions Required

Disable or uninstall the LeadBI plugin until a patched release is available and verified
Audit all posts and pages containing the leadbi_form shortcode and remove or sanitize any suspicious form_id attribute values
Restrict Contributor and Author role assignments to trusted users only, and review recent role changes
Force password resets and invalidate active sessions for administrator accounts that may have viewed malicious content

Patch Information

At the time of publication, no fixed version is indicated in the NVD record. All versions up to and including 1.7 are vulnerable. Review the WordPress Leadbi Plugin Page for updates and apply any vendor-released patch immediately upon availability.

Workarounds

Remove the leadbi_form shortcode from all published content and disable the plugin at the site level
Apply a Web Application Firewall (WAF) rule that blocks shortcode parameters containing HTML control characters such as <, >, and "
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Limit Contributor and Author roles, and require editorial review before previewing or publishing submitted content

bash

# Disable the LeadBI plugin via WP-CLI as an immediate mitigation
wp plugin deactivate leadbi
wp plugin status leadbi

# Search the database for shortcode usage prior to remediation
wp db query "SELECT ID, post_title, post_author FROM wp_posts \
  WHERE post_content LIKE '%leadbi_form%' AND post_status IN ('publish','pending','draft');"