CVE-2026-1755: Menu Icons by ThemeIsle XSS Vulnerability

CVE-2026-1755 Overview

The Menu Icons by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the _wp_attachment_image_alt post meta in all versions up to, and including, 0.13.20. The vulnerability stems from insufficient input sanitization and output escaping, allowing authenticated attackers with Author-level access and above to inject arbitrary web scripts into pages. These malicious scripts execute whenever a user accesses an injected page, potentially leading to session hijacking, credential theft, or further compromise of the WordPress installation.

Critical Impact

Authenticated attackers with Author-level privileges can inject persistent malicious scripts that execute in the browsers of all users visiting affected pages, enabling session theft, defacement, or phishing attacks.

Affected Products

• Menu Icons by ThemeIsle WordPress Plugin versions up to and including 0.13.20
• WordPress installations utilizing the affected plugin versions
• Any website using the vulnerable _wp_attachment_image_alt post meta functionality

Discovery Timeline

• February 3, 2026 - CVE-2026-1755 published to NVD
• February 4, 2026 - Last updated in NVD database

Technical Details for CVE-2026-1755

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability exists in the Menu Icons plugin's handling of image alt text metadata. The plugin fails to properly sanitize user-supplied input in the _wp_attachment_image_alt post meta field before storing it in the database, and subsequently fails to escape this data when rendering it on the frontend. This creates a persistent XSS condition where malicious JavaScript payloads are stored server-side and delivered to every user who views a page containing the compromised menu icon.

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), which encompasses cross-site scripting flaws. What makes this particularly concerning is that Authors—a relatively common user role in WordPress—have sufficient privileges to exploit this vulnerability, lowering the barrier for exploitation in multi-user WordPress environments.

Root Cause

The root cause of this vulnerability lies in the improper handling of the _wp_attachment_image_alt post meta within the includes/front.php file at line 497. The plugin retrieves the alt text metadata and includes it in the HTML output without adequate sanitization or escaping. WordPress provides built-in functions like esc_attr() and wp_kses() for sanitizing and escaping output, but these protections were not properly implemented in the affected code path, allowing arbitrary HTML and JavaScript to be injected through the alt text field.

Attack Vector

The attack is network-based and requires authenticated access with Author-level privileges or higher. An attacker would upload or modify an image attachment, setting the _wp_attachment_image_alt metadata to contain a malicious JavaScript payload. When this image is used as a menu icon and the menu is rendered on the frontend, the unsanitized alt text is included in the page HTML, causing the malicious script to execute in the browsers of all visitors.

The vulnerability mechanism involves insufficient input validation on the alt text field, combined with missing output escaping when rendering menu icons. Attackers can craft payloads that steal session cookies, redirect users to phishing pages, or perform actions on behalf of authenticated administrators. For detailed technical analysis, see the Wordfence Vulnerability Report and the vulnerable source code.

Detection Methods for CVE-2026-1755

Indicators of Compromise

• Suspicious JavaScript content in _wp_attachment_image_alt post meta values containing <script> tags, event handlers, or encoded payloads
• Unexpected modifications to attachment metadata by Author-level users
• Reports of browser-based attacks or unusual redirects from users visiting the site
• Database entries in wp_postmeta where meta_key equals _wp_attachment_image_alt containing HTML or script content

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect XSS patterns in HTTP requests targeting WordPress media endpoints
• Monitor WordPress database for suspicious content in the wp_postmeta table, particularly in alt text fields
• Deploy SentinelOne Singularity to detect malicious script execution and browser-based attack indicators
• Enable WordPress audit logging to track changes to attachment metadata by user role

Monitoring Recommendations

• Configure alerts for modifications to attachment metadata by non-administrator users
• Implement Content Security Policy (CSP) headers to mitigate the impact of successful XSS exploitation
• Regularly audit user roles and remove unnecessary Author-level privileges where possible

How to Mitigate CVE-2026-1755

Immediate Actions Required

• Update Menu Icons by ThemeIsle plugin to a version newer than 0.13.20 immediately
• Audit all existing _wp_attachment_image_alt values in the database for malicious content
• Review and restrict Author-level user accounts to only trusted individuals
• Consider temporarily disabling the plugin until the patch can be applied

Patch Information

The vulnerability has been addressed in a newer release of the Menu Icons plugin. The security fix involves proper sanitization and escaping of the _wp_attachment_image_alt post meta value before output. The patch details can be reviewed in the WordPress Menu Icons Changeset. Administrators should update to the latest available version through the WordPress plugin repository.

Workarounds

• Restrict the Author role from uploading or modifying media files using a role management plugin
• Implement a custom filter to sanitize alt text output until the patch is applied
• Use a Web Application Firewall with XSS filtering capabilities to block malicious payloads

# WordPress CLI command to check for suspicious alt text content
wp db query "SELECT post_id, meta_value FROM wp_postmeta WHERE meta_key = '_wp_attachment_image_alt' AND (meta_value LIKE '%<script%' OR meta_value LIKE '%javascript:%' OR meta_value LIKE '%onerror%' OR meta_value LIKE '%onload%');"