CVE-2026-12108: WordPress Highlighting Code Block XSS Flaw

CVE-2026-12108 Overview

CVE-2026-12108 is a stored Cross-Site Scripting (XSS) vulnerability in the Highlighting Code Block plugin for WordPress. The flaw affects all versions up to and including 2.2.0. It stems from insufficient input sanitization and output escaping in the plugin's admin settings interface. Authenticated attackers with administrator-level permissions can inject arbitrary web scripts into pages. Those scripts execute when any user accesses an affected page. The issue only impacts multi-site installations and installations where the unfiltered_html capability has been disabled. The vulnerability is tracked under CWE-79 and is documented in the Wordfence Vulnerability Report.

Critical Impact
Authenticated administrators on multi-site WordPress installations can inject persistent JavaScript that executes in the browsers of subsequent visitors, enabling session theft and administrative actions on behalf of other users.

Affected Products

Highlighting Code Block plugin for WordPress, versions through 2.2.0
WordPress multi-site installations using the plugin
WordPress installations where unfiltered_html capability has been disabled

Discovery Timeline

2026-07-10 - CVE-2026-12108 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-12108

Vulnerability Analysis

The Highlighting Code Block plugin exposes admin settings fields that accept user input without sufficient sanitization. The stored values are later rendered to page output without proper escaping. This allows an authenticated administrator to persist arbitrary HTML and JavaScript in the plugin's stored configuration. When those values are emitted into the page, the injected script executes in the browser of any visitor to the affected page. The relevant sinks reside in class/loos_hcb.php, class/loos_hcb_menu.php, and class/loos_hcb_scripts.php, as referenced in the WordPress plugin trac.

The attack surface is intentionally narrow. On standard single-site WordPress installations, administrators already hold the unfiltered_html capability, which lawfully permits raw HTML input. The vulnerability becomes exploitable only where that capability has been removed — most commonly on WordPress multi-site networks where only Super Admins retain unfiltered_html.

Root Cause

The root cause is missing input sanitization on admin-supplied plugin settings, combined with missing output escaping when those settings are rendered. The plugin trusts that any user reaching the settings page holds unfiltered_html, an assumption that fails in multi-site environments and hardened deployments.

Attack Vector

Exploitation requires authenticated access at administrator level or above and a network path to the plugin's settings interface. An attacker submits crafted script payloads through the vulnerable settings fields. The plugin persists the payload, and subsequent page loads execute the script in visitors' browsers. In a multi-site network this permits a site administrator on one subsite to attack users of that subsite, including Super Admins who visit affected pages.

No verified public exploit code is available. The vulnerability is described in prose in the Wordfence advisory and the corresponding WordPress change set 3592103.

Detection Methods for CVE-2026-12108

Indicators of Compromise

Plugin option values in wp_options containing <script> tags, on*= event handlers, or javascript: URIs associated with the highlighting-code-block option keys.
Unexpected outbound requests from visitor browsers to attacker-controlled domains after loading pages that render plugin settings.
Administrator audit-log entries showing modification of Highlighting Code Block settings by non-Super Admin accounts on multi-site installations.

Detection Strategies

Query the WordPress database for plugin option rows and inspect stored values for HTML or JavaScript payloads.
Deploy a Web Application Firewall (WAF) rule that inspects POST requests to the plugin's settings endpoint for script tags and event-handler attributes.
Compare stored plugin settings against a known-good baseline after each administrative change.

Monitoring Recommendations

Enable WordPress audit logging for update_option calls targeting Highlighting Code Block keys.
Alert on any administrator-level login originating from a new IP or user agent on multi-site networks.
Monitor server access logs for repeated POST requests to /wp-admin/options-general.php or the plugin's settings slug from a single authenticated session.

How to Mitigate CVE-2026-12108

Immediate Actions Required

Update the Highlighting Code Block plugin to a version later than 2.2.0 that includes the fix from WordPress change set 3592103.
Audit all administrator and Super Admin accounts on multi-site installations and remove unused privileges.
Inspect existing plugin settings values for injected scripts and clear any suspicious payloads.

Patch Information

The vendor addressed the issue in the commit referenced by change set 3592103. Site operators should upgrade to the first plugin release that incorporates that change set. Verify installed versions with wp plugin list --name=highlighting-code-block if using WP-CLI.

Workarounds

Deactivate the Highlighting Code Block plugin until the patched version is installed on multi-site networks.
Restrict administrator role assignments on multi-site networks so that only trusted principals can reach the vulnerable settings screen.
Restore the unfiltered_html capability only for trusted, isolated administrators, or deploy a WAF rule that blocks script content in the plugin's admin POST parameters.

bash

# Verify plugin version and update via WP-CLI
wp plugin list --name=highlighting-code-block
wp plugin update highlighting-code-block

# Search for potentially injected payloads in stored options
wp db query "SELECT option_name, option_value FROM wp_options \
  WHERE option_name LIKE '%hcb%' \
  AND (option_value LIKE '%<script%' OR option_value LIKE '%javascript:%');"