CVE-2026-1295: Buy Now Plus WordPress Plugin XSS Flaw

CVE-2026-1295 Overview

The Buy Now Plus – Buy Now buttons for Stripe plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the buynowplus shortcode functionality. The vulnerability exists in all versions up to and including 1.0.2 due to insufficient input sanitization and output escaping on shortcode attributes. This security flaw enables authenticated attackers with Contributor-level access or above to inject arbitrary web scripts into pages that execute whenever a user accesses an affected page.

Critical Impact

Authenticated attackers can persistently inject malicious JavaScript through WordPress shortcodes, potentially leading to session hijacking, credential theft, website defacement, or malware distribution to site visitors.

Affected Products

• Buy Now Plus – Buy Now buttons for Stripe WordPress Plugin version 1.0.2 and earlier
• WordPress sites using vulnerable versions of the Buy Now Plus plugin
• Any WordPress installation with Contributor-level or higher user accounts using the affected plugin

Discovery Timeline

• 2026-01-28 - CVE CVE-2026-1295 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-1295

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The flaw resides in the class-bnp-buttons.php file, specifically in how the plugin processes shortcode attributes without proper sanitization before rendering them in the HTML output.

When a WordPress contributor creates or edits a page using the buynowplus shortcode, the plugin fails to properly sanitize and escape user-supplied attribute values. This allows malicious script content to be stored in the WordPress database and subsequently executed in the browsers of any users who view the affected page.

The vulnerability requires authentication with at least Contributor-level privileges, which provides some mitigation against anonymous attacks. However, in multi-author WordPress environments or sites that allow user registrations with contributor capabilities, this represents a significant risk vector.

Root Cause

The root cause of this vulnerability is the lack of proper input sanitization and output escaping mechanisms in the shortcode rendering process. The plugin's class-bnp-buttons.php file processes shortcode attributes at lines 17 and 36 without implementing WordPress's built-in sanitization functions such as esc_attr(), esc_html(), or wp_kses(). This oversight allows arbitrary HTML and JavaScript code to pass through and be rendered in the page output.

Attack Vector

The attack is network-based and requires the attacker to have authenticated access to a WordPress site with at least Contributor-level permissions. The attacker would craft a malicious shortcode containing JavaScript payload within the shortcode attributes and embed it in a post or page. When any user (including administrators) views the page containing the malicious shortcode, the injected script executes in their browser context.

A typical attack scenario involves an attacker with contributor access inserting a specially crafted [buynowplus] shortcode with malicious JavaScript embedded in one of its attributes. Since the plugin stores this content without sanitization, the payload persists in the database and executes for every subsequent page view, making this a stored XSS attack with potentially wide-reaching impact.

Detection Methods for CVE-2026-1295

Indicators of Compromise

• Unexpected JavaScript code or event handlers within buynowplus shortcode attributes in WordPress posts or pages
• Suspicious activity in WordPress audit logs showing contributors editing pages with unusual shortcode content
• Reports from users experiencing unexpected browser behavior or redirects when viewing pages with Buy Now Plus buttons
• Web Application Firewall logs showing blocked XSS attempts targeting shortcode parameters

Detection Strategies

• Review all content containing buynowplus shortcodes for suspicious JavaScript, event handlers, or encoded payloads
• Implement Content Security Policy (CSP) headers to detect and block unauthorized inline script execution
• Deploy WordPress security plugins that scan for known XSS patterns in post content
• Enable database auditing to track changes to posts containing the affected shortcode

Monitoring Recommendations

• Configure Web Application Firewall (WAF) rules to detect XSS patterns in WordPress shortcode content
• Monitor WordPress user activity logs for unusual content modifications by contributor-level accounts
• Set up alerts for new or modified pages containing the buynowplus shortcode
• Implement browser-based XSS detection using CSP violation reporting

How to Mitigate CVE-2026-1295

Immediate Actions Required

• Update the Buy Now Plus plugin to the latest patched version immediately
• Review all existing content for potentially malicious shortcode injections and remove any suspicious content
• Audit contributor-level accounts and consider temporarily restricting shortcode usage permissions
• Implement Web Application Firewall rules to block XSS attack patterns

Patch Information

The vulnerability was addressed in a plugin update. Refer to the WordPress Plugin Change Log for details on the security fix. Additional vulnerability information is available in the Wordfence Vulnerability Report. The patch implements proper sanitization and escaping of shortcode attributes in the class-bnp-buttons.php file.

Workarounds

• Disable the Buy Now Plus plugin until a patched version can be installed
• Restrict WordPress user roles to prevent untrusted users from having Contributor-level access or above
• Implement Content Security Policy headers to mitigate the impact of any injected scripts
• Use WordPress security plugins to scan and block XSS attempts in shortcode content

# Configuration example - Add Content Security Policy header in .htaccess
<IfModule mod_headers.c>
    Header set Content-Security-Policy "default-src 'self'; script-src 'self' https://js.stripe.com; style-src 'self' 'unsafe-inline';"
</IfModule>