CVE-2026-1401: Tune Library Plugin for WordPress XSS Flaw

CVE-2026-1401 Overview

CVE-2026-1401 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the Tune Library plugin for WordPress in all versions up to and including 1.6.3. The flaw resides in the CSV import functionality, which lacks both authorization checks and input sanitization. Authenticated attackers holding Subscriber-level privileges or higher can import malicious CSV data containing arbitrary web scripts. The imported content is later rendered without output escaping through the [tune-library] shortcode, executing scripts in the browser of any visitor who views the affected page.

Critical Impact
Authenticated attackers with Subscriber access can inject persistent JavaScript that executes in administrator and visitor browsers, enabling session theft and unauthorized actions in the WordPress dashboard.

Affected Products

Tune Library plugin for WordPress, versions up through 1.6.3
WordPress sites with Subscriber registration enabled and the plugin active
Pages and posts rendering the [tune-library] shortcode

Discovery Timeline

2026-02-06 - CVE-2026-1401 published to the National Vulnerability Database
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-1401

Vulnerability Analysis

The Tune Library plugin exposes a CSV import handler that ingests user-supplied attribute data into the plugin's data store. The handler does not enforce capability or nonce checks, so any authenticated user — including the lowest-privilege Subscriber role — can invoke the import. Imported field values are stored verbatim and later emitted by the [tune-library] shortcode without HTML encoding. When an administrator or visitor loads a page containing the shortcode, the browser parses the attacker-controlled payload as HTML and executes embedded <script> content in the site's origin.

Because the payload is stored server-side and triggered by normal page rendering, the attack is persistent and does not require further interaction from the attacker. The CVSS scope change reflects that script execution in an administrator session can affect resources beyond the plugin itself, including site configuration and other authenticated users.

Root Cause

Two defects combine to produce the vulnerability. First, the CSV import routine in tune-library.php does not call current_user_can() or verify a WordPress nonce before processing uploaded data. Second, the rendering path in writeNodes.php outputs stored attribute values directly into HTML without invoking esc_html(), esc_attr(), or equivalent escaping helpers. The plugin trusts imported data as safe content rather than treating it as untrusted user input.

Attack Vector

An attacker registers or uses an existing Subscriber-level account on a target WordPress site running a vulnerable Tune Library version. The attacker submits a crafted CSV file to the plugin's import endpoint, embedding JavaScript payloads in fields that map to attributes rendered by the shortcode. When any user — typically an administrator browsing the library page — loads the affected content, the injected script executes with that user's privileges. Common follow-on actions include exfiltrating authentication cookies, creating new administrator accounts, or pivoting to plugin-level remote code execution.

Technical details are documented in the Wordfence Vulnerability Analysis and the WordPress Plugin Code Review.

Detection Methods for CVE-2026-1401

Indicators of Compromise

CSV upload requests from non-administrator accounts targeting Tune Library import endpoints
Tune Library database records containing <script>, onerror=, onload=, or javascript: substrings in attribute fields
Unexpected administrator account creation or role changes following access to pages containing the [tune-library] shortcode
Outbound requests from administrator browsers to unfamiliar domains immediately after viewing library pages

Detection Strategies

Audit WordPress posts, pages, and the plugin's data tables for HTML tags or JavaScript event handlers in Tune Library attribute fields
Review web server access logs for POST requests to admin-ajax.php or plugin import handlers originating from low-privilege user sessions
Inspect rendered HTML of pages using the [tune-library] shortcode for unescaped angle brackets or inline script tags

Monitoring Recommendations

Enable WordPress activity logging for user role changes, plugin file modifications, and CSV upload events
Alert on Subscriber and Contributor accounts invoking import or admin-ajax endpoints
Monitor for newly created administrator accounts and unscheduled plugin or theme installations

How to Mitigate CVE-2026-1401

Immediate Actions Required

Update the Tune Library plugin to a version newer than 1.6.3 that includes the fix referenced in the WordPress Plugin Changeset
Audit existing Tune Library records and remove any entries containing script tags or HTML event handlers
Review the user list and disable or delete unrecognized Subscriber-level accounts
Rotate administrator credentials and invalidate active sessions if compromise is suspected

Patch Information

The plugin vendor released a fix tracked in changeset 3451457. The patch adds authorization checks to the CSV import handler and applies output escaping to attributes rendered by the [tune-library] shortcode. Apply the update through the WordPress plugin dashboard or by replacing plugin files from the official repository.

Workarounds

Deactivate the Tune Library plugin until the patched version is installed
Disable open user registration or restrict new accounts to a custom role without access to the plugin
Deploy a web application firewall rule that blocks CSV uploads containing <script, onerror=, or javascript: substrings
Remove the [tune-library] shortcode from public pages until remediation is complete

bash

# Configuration example: disable open registration in wp-config.php context
wp option update users_can_register 0
wp option update default_role subscriber

# Deactivate the vulnerable plugin via WP-CLI
wp plugin deactivate tune-library