CVE-2026-1654: Peter's Date Countdown Plugin XSS Flaw

CVE-2026-1654 Overview

The Peter's Date Countdown plugin for WordPress contains a Reflected Cross-Site Scripting (XSS) vulnerability in the $_SERVER['PHP_SELF'] parameter. This security flaw affects all versions up to and including 2.0.0 and stems from insufficient input sanitization and output escaping. The vulnerability enables unauthenticated attackers to inject arbitrary web scripts into pages that execute when a user is tricked into clicking a malicious link.

Critical Impact

Unauthenticated attackers can inject malicious JavaScript code that executes in the context of the victim's browser session, potentially leading to session hijacking, credential theft, or further attacks against WordPress administrators.

Affected Products

• Peter's Date Countdown plugin for WordPress versions up to and including 2.0.0
• WordPress sites using vulnerable versions of the Peter's Date Countdown plugin

Discovery Timeline

• February 5, 2026 - CVE-2026-1654 published to NVD
• February 5, 2026 - Last updated in NVD database

Technical Details for CVE-2026-1654

Vulnerability Analysis

This Reflected Cross-Site Scripting (CWE-79) vulnerability exists in the Peter's Date Countdown WordPress plugin due to improper handling of the $_SERVER['PHP_SELF'] superglobal variable. When this variable is used in output without proper sanitization or escaping, attackers can craft malicious URLs containing JavaScript payloads that get reflected back to users and executed in their browsers.

The vulnerable code is located in datecountdown.php at line 246, where user-controlled input from the PHP_SELF server variable is rendered without adequate security controls. This allows attackers to inject script tags or event handlers that execute arbitrary JavaScript when a victim visits the crafted URL.

Root Cause

The root cause of this vulnerability is the direct use of $_SERVER['PHP_SELF'] in HTML output without applying proper output escaping functions such as esc_url() or esc_attr(). The PHP_SELF variable contains the filename of the currently executing script relative to the document root, but it can be manipulated by appending arbitrary content to the URL path. When this unsanitized value is echoed into HTML (typically in form action attributes), the attacker-controlled portion gets rendered as executable markup.

Attack Vector

The attack requires user interaction (UI:R) as specified in the vulnerability characteristics. An attacker must craft a malicious URL containing JavaScript payload and convince a victim to click the link. The attack is network-accessible and requires no authentication or special privileges to execute.

A typical attack scenario involves:

1. The attacker identifies a WordPress site using the vulnerable Peter's Date Countdown plugin
2. The attacker crafts a URL with malicious JavaScript appended to the path
3. The victim (typically a WordPress administrator) clicks the link, often delivered via phishing
4. The malicious script executes in the victim's browser with their session context
5. The attacker can steal session cookies, perform actions as the victim, or redirect to malicious sites

For technical details on the vulnerable code pattern, see the WordPress Countdown Plugin Code reference.

Detection Methods for CVE-2026-1654

Indicators of Compromise

• Unusual URL patterns in web server logs containing encoded JavaScript or HTML tags in the request path
• Access logs showing requests to plugin pages with malformed or suspicious PHP_SELF paths
• User reports of unexpected redirects or browser warnings when accessing WordPress admin pages
• Evidence of session hijacking or unauthorized administrative actions

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block XSS payloads in URL paths
• Monitor web server access logs for requests containing <script>, javascript:, or encoded variants in the URL
• Deploy browser-based XSS protection headers and Content Security Policy (CSP)
• Use WordPress security plugins that detect exploitation attempts against known vulnerabilities

Monitoring Recommendations

• Enable verbose logging on WordPress installations and review for anomalous URL patterns
• Configure SIEM rules to alert on potential XSS exploitation attempts targeting WordPress plugins
• Monitor for changes to WordPress user sessions or unexpected administrative activity
• Review the Wordfence Vulnerability Report for updated threat intelligence

How to Mitigate CVE-2026-1654

Immediate Actions Required

• Update Peter's Date Countdown plugin to the latest patched version immediately
• If update is not possible, deactivate and remove the vulnerable plugin until a patch can be applied
• Review web server logs for signs of exploitation attempts
• Implement a Web Application Firewall with XSS protection rules
• Educate users about the risks of clicking untrusted links

Patch Information

A security patch has been released to address this vulnerability. The fix involves proper sanitization and escaping of the $_SERVER['PHP_SELF'] variable before it is used in HTML output. Site administrators should update to the latest version of the plugin immediately.

The patch details can be reviewed at WordPress Changeset #3450122.

Workarounds

• Deactivate the Peter's Date Countdown plugin until the update can be applied
• Deploy a Web Application Firewall (WAF) rule to filter malicious payloads in URL paths
• Implement Content Security Policy (CSP) headers to mitigate the impact of successful XSS attacks
• Use WordPress security plugins that provide virtual patching capabilities for known vulnerabilities

# Example: Add Content Security Policy header in .htaccess
<IfModule mod_headers.c>
    Header set Content-Security-Policy "default-src 'self'; script-src 'self'"
</IfModule>