CVE-2026-1843 Overview
CVE-2026-1843 is a Stored Cross-Site Scripting (XSS) vulnerability in the Super Page Cache plugin for WordPress, affecting all versions up to and including 5.2.2. The flaw exists in the plugin's Activity Log functionality, which fails to perform adequate input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when any user views an affected page. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Unauthenticated attackers can inject persistent JavaScript payloads into the plugin's Activity Log, leading to session hijacking, administrative account takeover, and arbitrary actions in the browser context of any user viewing the log.
Affected Products
- Super Page Cache plugin for WordPress (also distributed as wp-cloudflare-page-cache)
- All versions through 5.2.2
- WordPress sites with the plugin's Activity Log feature enabled
Discovery Timeline
- 2026-02-14 - CVE-2026-1843 published to the National Vulnerability Database
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2026-1843
Vulnerability Analysis
The Super Page Cache plugin records request and event metadata to an Activity Log accessible to site administrators. The plugin writes user-controlled values from HTTP requests into this log without applying WordPress sanitization helpers such as sanitize_text_field() on input. The log entries are then rendered in the WordPress admin interface without escaping helpers such as esc_html() or esc_attr() on output.
This dual failure allows an attacker to submit a crafted request containing HTML or JavaScript that is stored verbatim. When an administrator or other privileged user opens the Activity Log, the browser parses and executes the injected payload in the context of the WordPress site.
Because the attack changes execution context to a privileged session, the scope is changed (S:C). An attacker can leverage the executed script to create new administrator accounts, exfiltrate nonces, modify plugin settings, or pivot to further actions through the WordPress REST API.
Root Cause
The root cause is insufficient input sanitization combined with missing output escaping in the Activity Log code path. WordPress provides a well-defined set of sanitization and escaping functions, and the plugin failed to apply them to attacker-controlled request fields recorded into log entries.
Attack Vector
The attack is delivered over the network and requires no authentication or user interaction beyond the eventual viewing of the Activity Log by a privileged user. An attacker sends an HTTP request to the target WordPress site containing malicious script content in a field that the plugin captures into its Activity Log. The payload remains stored until a logged-in administrator views the log, at which point the script executes in the administrator's browser.
Detailed technical context is available in the Wordfence Vulnerability Report and the WordPress Plugin Changeset that introduces the fix.
Detection Methods for CVE-2026-1843
Indicators of Compromise
- Activity Log entries containing HTML tags such as <script>, <img onerror=, or <svg onload=
- Unexpected administrator accounts or modified user roles in wp_users and wp_usermeta
- Outbound HTTP requests from administrator browsers to unknown domains shortly after viewing the plugin's Activity Log
- Plugin or theme installations from the WordPress admin that do not correlate with legitimate administrator activity
Detection Strategies
- Inspect the Super Page Cache Activity Log database table for entries containing angle brackets, javascript: URIs, or HTML event handlers
- Review WordPress access logs for unauthenticated POST or GET requests targeting plugin endpoints with suspicious payloads
- Compare the installed plugin version against 5.2.2; any version at or below is vulnerable
- Deploy a Web Application Firewall (WAF) rule set that flags XSS payload patterns in requests to WordPress sites
Monitoring Recommendations
- Alert on creation of WordPress administrator accounts outside change-control windows
- Monitor file integrity for wp-content/plugins/wp-cloudflare-page-cache/ to detect unauthorized modification
- Forward WordPress audit logs to a centralized SIEM and correlate plugin log writes with administrative session activity
- Track outbound traffic from administrative workstations for connections to recently registered domains
How to Mitigate CVE-2026-1843
Immediate Actions Required
- Update the Super Page Cache plugin to the version released in changeset 3454474 or later
- Purge existing Activity Log entries to remove any stored payloads before administrators view the log
- Rotate WordPress administrator passwords and invalidate active sessions if compromise is suspected
- Audit wp_users for unauthorized accounts created after the plugin was installed
Patch Information
The vendor addressed the issue in the plugin update referenced by WordPress Plugin Changeset 3454474. The fix applies proper sanitization on input and escaping on output for Activity Log entries. Sites running version 5.2.2 or earlier must upgrade to the patched release.
Workarounds
- Disable the Activity Log feature in the Super Page Cache plugin configuration until the patch is applied
- Deactivate the plugin entirely on high-value WordPress installations where immediate patching is not feasible
- Restrict access to the WordPress admin interface by IP allowlist at the web server or WAF tier
- Apply a WAF rule that blocks requests containing HTML or script tags destined for plugin endpoints
# Example: WP-CLI commands to update the plugin and verify the installed version
wp plugin update wp-cloudflare-page-cache
wp plugin get wp-cloudflare-page-cache --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
