CVE-2026-15404 Overview
CVE-2026-15404 is a Stored Cross-Site Scripting (XSS) vulnerability in the Lpagery plugin for WordPress affecting all versions up to and including 2.5.7. The flaw resides in the lpagery_add_filter_text_template_post() function, which is hooked to admin_footer and echoes the raw post_title of a post referenced by the ?lpagery_template query parameter directly inside a JavaScript single-quoted string literal. The function omits esc_js(), esc_html(), and any other output encoding. Authenticated attackers with Contributor-level access or above can inject arbitrary scripts that execute when a higher-privileged user, such as an administrator, visits an admin page carrying the crafted ?lpagery_template=<post_id> parameter.
Critical Impact
Contributor-level accounts can escalate to administrator-scope actions by executing JavaScript in an administrator's authenticated browser session.
Affected Products
- Lpagery plugin for WordPress, versions ≤ 2.5.7
- WordPress sites permitting Contributor-level (or higher) registrations
- Administrator sessions accessing admin pages with the lpagery_template parameter
Discovery Timeline
- 2026-07-23 - CVE-2026-15404 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-15404
Vulnerability Analysis
The vulnerability is a classic stored XSS ([CWE-79]) rooted in unsafe output handling within a JavaScript context. In lpagery.php around lines 502–513, the plugin registers lpagery_add_filter_text_template_post() as a callback for the admin_footer action. When an administrator loads any WordPress admin page with the ?lpagery_template=<post_id> query string, the plugin fetches the referenced post and writes its post_title value directly into an inline <script> block, wrapped only in single quotes.
Because the value is emitted without esc_js() or equivalent encoding, an attacker who controls the post title can break out of the single-quoted literal using a single quote followed by JavaScript. The injected script runs with the privileges of the currently authenticated admin user, enabling actions such as creating new administrator accounts, modifying plugin settings, or planting persistent backdoors.
Root Cause
The root cause is missing input sanitization on save and missing output escaping on render. Post titles retain any characters permitted by WordPress, and the plugin trusts that content when concatenating it into a JavaScript string. The correct pattern is to pass the title through esc_js() when emitting inside a JS literal, or wp_json_encode() for structured values.
Attack Vector
Exploitation requires an authenticated account with the Contributor role or higher. The attacker creates or edits a post whose title contains a JavaScript payload that closes the surrounding single-quoted string. The attacker then delivers a link to the WordPress admin area containing ?lpagery_template=<attacker_post_id>, or waits for a legitimate workflow that opens that URL. When an administrator loads the page, the injected script executes in the admin's browser under the site origin. The scope-changed nature of the flaw reflects that a lower-privileged actor can affect a higher-privileged context.
No verified public proof-of-concept code has been released. Technical details are documented in the WordPress Plugin Code Reference at line 502, line 504, and line 513, and in the Wordfence Vulnerability Report.
Detection Methods for CVE-2026-15404
Indicators of Compromise
- WordPress posts authored by Contributor-level accounts whose post_title contains single quotes followed by JavaScript keywords such as alert(, fetch(, document., or <script.
- Admin-area access logs showing requests containing the lpagery_template query parameter, especially from administrator sessions shortly after Contributor post activity.
- Unexpected creation of new administrator accounts, plugin installations, or modified wp_options values following admin visits to affected pages.
Detection Strategies
- Query the wp_posts table for titles containing characters like ', <, >, or script where post_author maps to a Contributor role.
- Inspect web server access logs for GET requests to /wp-admin/* containing lpagery_template= and correlate with the referenced post ID.
- Deploy web application firewall rules that flag inline JavaScript payloads submitted via the WordPress post editor REST endpoint (/wp-json/wp/v2/posts).
Monitoring Recommendations
- Alert on new user registrations receiving the administrator role outside of change-management windows.
- Monitor for modifications to active theme files, wp-config.php, or the active_plugins option, which are common post-exploitation actions after admin session hijacking.
- Audit Lpagery plugin usage and log every admin page load that includes the lpagery_template parameter.
How to Mitigate CVE-2026-15404
Immediate Actions Required
- Update the Lpagery plugin to a version later than 2.5.7 that addresses the escaping issue, as tracked in the WordPress Change Log Entry.
- Audit all Contributor, Author, and Editor accounts for legitimacy and review recent post titles for suspicious characters.
- Force password resets and invalidate active sessions for administrator accounts that may have loaded an affected admin URL.
Patch Information
The plugin author committed a fix referenced in the WordPress Plugin Directory changeset. Site owners should upgrade to the fixed release published after 2.5.7. Refer to the Wordfence Vulnerability Report for the exact fixed version and remediation details.
Workarounds
- Deactivate and remove the Lpagery plugin until the site can be upgraded to a patched release.
- Restrict Contributor and higher registrations, or require manual approval for new accounts.
- Deploy a WAF rule that blocks admin-area requests containing the lpagery_template query parameter until patching is complete.
# Configuration example: WP-CLI commands to update the plugin and audit users
wp plugin update lpagery
wp plugin list --name=lpagery --fields=name,status,version
wp user list --role=contributor --fields=ID,user_login,user_registered
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
