CVE-2026-15796: Builderall WordPress Plugin XSS Vulnerability

CVE-2026-15796 Overview

CVE-2026-15796 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the Builderall for WordPress plugin (also known as builderall-cheetah-for-wp). The flaw exists in all versions up to and including 3.0.2. It stems from insufficient input sanitization and output escaping in the bg_video_service_url setting used by the plugin's video row component. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript that executes in the browser of any visitor who loads an affected page.

Critical Impact
Authenticated contributors can inject persistent JavaScript into pages, enabling session hijacking, credential theft, and privilege escalation against site administrators who view compromised content.

Affected Products

Builderall for WordPress plugin (builderall-cheetah-for-wp) — all versions through 3.0.2
WordPress sites permitting contributor-level registration or with existing contributor accounts
Any page built using the plugin's video row component that renders bg_video_service_url

Discovery Timeline

2026-09-10 - CVE-2026-15796 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-15796

Vulnerability Analysis

The vulnerability resides in the plugin's video row rendering path. The bg_video_service_url setting is accepted from authenticated users through the plugin's AJAX handler defined in class-ba-cheetah-ajax.php, persisted through the model layer in class-ba-cheetah-model.php, and later emitted by row-video.php when the page is rendered.

Input passing through this flow is neither sanitized on write nor escaped on output. As a result, script payloads placed in the bg_video_service_url field are stored in the post or module configuration and rendered verbatim inside the video row markup. Every visitor loading the affected page executes the injected script in their browser session.

Attackers require only contributor privileges, a role commonly granted for guest posting on WordPress sites. The injected payload runs with the page viewer's privileges, which frequently includes administrators reviewing contributor drafts.

Root Cause

The root cause is missing input sanitization when the bg_video_service_url value is saved and missing output escaping when the value is rendered. The plugin does not apply WordPress functions such as esc_url(), esc_attr(), or wp_kses() at the correct boundaries in class-ba-cheetah-utils.php and row-video.php. This allows the setting to store and reflect arbitrary strings, including HTML and JavaScript.

Attack Vector

Exploitation proceeds over the network against the plugin's AJAX endpoint. An authenticated attacker with contributor privileges sends a save request that places a JavaScript payload into the bg_video_service_url field of a video row module. The payload is stored in the database. When any user, including higher-privileged administrators, views the resulting page, the browser parses the injected content and executes the attacker-controlled script in the site's origin.

Refer to the plugin source at WordPress Plugin Code - Video Row and the Wordfence Vulnerability Report for the specific rendering context.

Detection Methods for CVE-2026-15796

Indicators of Compromise

Video row modules where bg_video_service_url contains characters outside a valid URL character set, such as <, >, ", or the strings javascript:, <script, or onerror=.
WordPress postmeta or plugin option rows referencing builderall-cheetah module data with HTML or script fragments.
Outbound requests from visitor browsers to unfamiliar domains immediately after loading pages built with the Builderall plugin.
New or unexpected administrator accounts, cookie theft artifacts, or unauthorized plugin installations following contributor activity.

Detection Strategies

Query the WordPress database for stored plugin settings containing suspicious tokens, for example SELECT * FROM wp_postmeta WHERE meta_value LIKE '%bg_video_service_url%<%'.
Review web server access logs for POST requests to admin-ajax.php originating from contributor accounts that modify Builderall video rows.
Inspect rendered HTML of published pages for script tags or event handlers appearing inside video row containers.
Correlate contributor account activity with subsequent administrator session anomalies.

Monitoring Recommendations

Alert on any content save action by contributor-level accounts that touches Builderall module configuration.
Monitor for unexpected changes to wp_options and wp_postmeta entries associated with the plugin.
Enforce Content Security Policy (CSP) reporting to surface script executions from unexpected sources on plugin-rendered pages.
Track privilege changes, plugin installations, and administrator logins that follow visits to attacker-modified pages.

How to Mitigate CVE-2026-15796

Immediate Actions Required

Update the Builderall for WordPress plugin to a version later than 3.0.2 once the vendor publishes a fix.
Audit existing video row modules for injected content in the bg_video_service_url field and remove malicious values.
Review and reduce the number of accounts holding contributor or higher privileges, revoking access where not required.
Rotate credentials and session cookies for administrators who may have viewed attacker-controlled pages.

Patch Information

At the time of publication, the Wordfence Vulnerability Report documents the issue as affecting all versions through 3.0.2. Site operators should monitor the plugin's page on the WordPress Plugin Directory for a patched release and apply it promptly. Review the vulnerable code paths in WordPress Plugin Code - AJAX Class and WordPress Plugin Code - Utils Class to confirm the fix applies sanitization and escaping in both locations.

Workarounds

Restrict contributor and author registration until a patched version is installed.
Deploy a Web Application Firewall (WAF) rule that blocks POST bodies to admin-ajax.php containing bg_video_service_url values with HTML metacharacters.
Apply a strict Content Security Policy that disallows inline scripts on pages rendered by the plugin.
Temporarily deactivate the Builderall for WordPress plugin on sites where contributor accounts are actively used and cannot be constrained.

bash

# Example WAF pattern (ModSecurity) blocking script payloads in the vulnerable parameter
SecRule ARGS:bg_video_service_url "@rx (?i)(<script|javascript:|onerror=|onload=)" \
    "id:1026157960,phase:2,deny,status:403,log,msg:'CVE-2026-15796 Builderall XSS attempt'"