CVE-2026-1611 Overview
CVE-2026-1611 is a Stored Cross-Site Scripting (XSS) vulnerability in the Wikiloops Track Player plugin for WordPress. The flaw affects all versions up to and including 1.0.1. It exists in the plugin's wikiloops shortcode, which fails to properly sanitize input or escape output on user-supplied attributes. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript into pages. Injected scripts execute in the browser of any visitor who views the affected page. The issue is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Contributor-level attackers can inject persistent JavaScript that executes against site visitors and administrators, enabling session theft, account takeover, and malicious redirects.
Affected Products
- Wikiloops Track Player plugin for WordPress (versions ≤ 1.0.1)
- WordPress sites using the wikiloops shortcode
- Any WordPress installation with contributor-level or higher user roles enabled
Discovery Timeline
- 2026-02-07 - CVE-2026-1611 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2026-1611
Vulnerability Analysis
The vulnerability resides in the wikiloops shortcode handler defined in Wikiloops-Track-Player.php. WordPress shortcodes accept user-supplied attributes that the plugin renders into HTML output. The plugin reflects these attribute values directly into the page markup without sanitization or escaping. Any attribute value containing HTML or JavaScript becomes executable content in the rendered page.
Because shortcodes are stored in post or page content, the injected payload persists in the database. Every subsequent visitor to the affected page triggers the payload. Contributors in WordPress can author posts but cannot publish them directly, yet the injected content executes once an editor or administrator reviews or publishes the post.
Root Cause
The root cause is missing input sanitization and missing output escaping on shortcode attributes. WordPress provides functions such as esc_attr(), esc_html(), and wp_kses() for safe attribute handling. The plugin code at the referenced source line does not apply these functions. The shortcode parameters flow directly into HTML attributes or inline script contexts.
Attack Vector
An attacker authenticated as a contributor or higher crafts a post containing the wikiloops shortcode with a malicious attribute value. The payload is stored in the WordPress database. When any user loads the page, the browser parses the injected script in the context of the site's origin. The attacker can steal session cookies, perform actions on behalf of the victim, or redirect users to attacker-controlled infrastructure. The scope is changed (S:C) because script execution affects users beyond the attacker's own account.
Review the plugin source at the WordPress Plugin Source Code and the Wordfence Vulnerability Report for technical details.
Detection Methods for CVE-2026-1611
Indicators of Compromise
- Posts or pages containing [wikiloops] shortcodes with attribute values that include <script>, onerror=, onload=, or javascript: strings.
- Unexpected outbound requests from visitor browsers to unknown domains when viewing pages with the plugin shortcode.
- New or modified administrator accounts created shortly after a contributor publishes content using the plugin.
Detection Strategies
- Query the wp_posts table for post_content entries matching the pattern [wikiloops combined with suspicious characters such as <, >, or javascript:.
- Inspect web server access logs for HTTP requests to pages containing the plugin shortcode followed by anomalous referrer or cookie-bearing requests to external hosts.
- Monitor browser Content Security Policy (CSP) violation reports for inline script execution on pages rendering the plugin.
Monitoring Recommendations
- Audit contributor and author account activity for unusual post creation patterns or shortcode usage.
- Enable WordPress audit logging plugins to capture post creation, modification, and shortcode rendering events.
- Forward WordPress and web server logs to a centralized SIEM for correlation against XSS payload signatures.
How to Mitigate CVE-2026-1611
Immediate Actions Required
- Deactivate and remove the Wikiloops Track Player plugin until a patched version is released.
- Audit all existing posts and pages for [wikiloops] shortcode usage and remove any suspicious attribute values.
- Restrict the contributor role assignment to trusted users only and review recent role changes.
- Force a password reset for administrator and editor accounts that may have viewed compromised pages.
Patch Information
At the time of publication, no fixed version is listed in the NVD entry. All versions up to and including 1.0.1 are vulnerable. Monitor the WordPress plugin repository for updates and apply any released patch promptly.
Workarounds
- Remove the plugin entirely if no patched release is available.
- Apply a web application firewall (WAF) rule that blocks shortcode attributes containing HTML tags or JavaScript event handlers.
- Implement a strict Content Security Policy that disallows inline scripts to limit the impact of stored XSS payloads.
- Reduce the default capabilities of the contributor role using a role management plugin to prevent shortcode usage in posts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
