CVE-2026-15820: Builderall WordPress Plugin XSS Vulnerability

CVE-2026-15820 Overview

CVE-2026-15820 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in the Builderall for WordPress plugin (also known as builderall-cheetah-for-wp). The flaw affects all versions up to and including 3.0.2 and resides in the Photo Module's attributes setting. Insufficient input sanitization and output escaping allow authenticated users with contributor-level access or above to inject arbitrary JavaScript. The injected payload executes in the browser of any user who visits an affected page.

Critical Impact
Contributor-level accounts can plant persistent JavaScript payloads that run in the context of site visitors and administrators, enabling session theft, account takeover, and malicious redirection.

Affected Products

Builderall for WordPress plugin (builderall-cheetah-for-wp)
All versions up to and including 3.0.2
WordPress installations exposing contributor-level or higher registration

Discovery Timeline

2026-09-10 - CVE-2026-15820 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-15820

Vulnerability Analysis

The vulnerability resides in the Photo Module of the Builderall for WordPress plugin. Attackers supply attacker-controlled values through the module's attributes setting, which the plugin persists to the WordPress database. When the module renders on the frontend, the stored values are echoed into page markup without proper escaping. Any JavaScript embedded in those values executes in the browser of every visitor to the page.

Because the affected save path is reachable through AJAX handlers exposed to authenticated users, contributors and higher roles can inject payloads without requiring editor or administrator permissions. The scope change reflected in the CVSS metrics indicates that the impact crosses trust boundaries, affecting logged-in administrators viewing content authored by lower-privileged users.

Root Cause

The root cause is missing input sanitization on write and missing output escaping on render for the Photo Module's attributes field. The plugin's model and frontend code paths in class-ba-cheetah-model.php, class-ba-cheetah-ajax.php, and modules/photo/includes/frontend.php accept and emit user-controlled data without applying WordPress escaping functions such as esc_attr() or wp_kses_post().

Attack Vector

Exploitation requires an authenticated session with contributor privileges or higher. The attacker submits a Photo Module configuration containing a crafted attributes value with an embedded script or event handler. The plugin stores the payload and later renders it on the target page. When an administrator, editor, or unauthenticated visitor loads the page, the JavaScript executes in their browser context, enabling actions such as session cookie theft, forced administrative requests, or drive-by redirection.

No verified proof-of-concept code has been published. See the Wordfence Vulnerability Report and the affected source in the WordPress Plugin Photo Module for the technical details.

Detection Methods for CVE-2026-15820

Indicators of Compromise

WordPress post or postmeta entries containing <script> tags, javascript: URIs, or DOM event handlers (onerror, onload, onmouseover) within Builderall Photo Module attributes values.
Unexpected outbound requests from browsers loading pages that embed the Builderall Photo Module.
New or unfamiliar administrator accounts, altered user roles, or unauthorized plugin installations following contributor activity.

Detection Strategies

Query the wp_postmeta and Builderall-specific tables for Photo Module payloads containing HTML tags or JavaScript keywords in the attributes field.
Review web server access logs for POST requests to admin-ajax.php invoking Builderall Cheetah actions from contributor accounts.
Compare rendered page HTML against expected module output to identify injected script content on pages using the Photo Module.

Monitoring Recommendations

Alert on WordPress role changes, new administrator creation, and plugin installations initiated by non-administrative sessions.
Enable a web application firewall (WAF) rule set that flags script-like content submitted through plugin AJAX endpoints.
Monitor Content Security Policy (CSP) violation reports for inline script execution on pages hosting the Photo Module.

How to Mitigate CVE-2026-15820

Immediate Actions Required

Update the Builderall for WordPress plugin to a version later than 3.0.2 once the vendor publishes a patched release.
Audit all contributor, author, and editor accounts, removing untrusted users and rotating credentials for retained accounts.
Inspect existing Photo Module content for injected <script> or event-handler payloads and remove any malicious values.
Rotate WordPress session tokens, secret keys in wp-config.php, and administrator passwords if injection is confirmed.

Patch Information

At time of publication, no fixed version is referenced in the NVD entry. Monitor the Wordfence Vulnerability Report and the plugin's WordPress.org page for a released update addressing the Photo Module attributes sanitization gap.

Workarounds

Deactivate the Builderall for WordPress plugin until a patched version is available.
Restrict contributor and author registration on affected sites, and require administrator approval for new accounts.
Deploy a WAF rule that blocks HTML tags and JavaScript event handlers in requests targeting Builderall AJAX endpoints.
Enforce a strict Content Security Policy that disallows inline scripts on pages served by WordPress.

bash

# Temporary mitigation: disable the vulnerable plugin using WP-CLI
wp plugin deactivate builderall-cheetah-for-wp

# Restrict new user registration and default role while auditing
wp option update users_can_register 0
wp option update default_role subscriber