CVE-2026-1893: Orbisius Random Name Generator XSS Flaw

CVE-2026-1893 Overview

CVE-2026-1893 is a Stored Cross-Site Scripting (XSS) vulnerability in the Orbisius Random Name Generator plugin for WordPress. The flaw affects all plugin versions up to and including 1.0.2. It originates in the btn_label parameter of the orbisius_random_name_generator shortcode, which lacks proper input sanitization and output escaping [CWE-79].

Authenticated users holding Contributor-level access or higher can inject arbitrary JavaScript into pages. The injected payload executes in the browser of every visitor who loads the affected page, enabling session theft, redirection, and administrative action abuse if a privileged user is targeted.

Critical Impact
Authenticated contributors can store JavaScript payloads that execute in any visitor's browser, including site administrators.

Affected Products

Orbisius Random Name Generator plugin for WordPress, versions up to and including 1.0.2
WordPress sites permitting Contributor-level account registration or self-service signup
WordPress installations using the orbisius_random_name_generator shortcode

Discovery Timeline

2026-02-11 - CVE-2026-1893 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-1893

Vulnerability Analysis

The Orbisius Random Name Generator plugin registers a WordPress shortcode named orbisius_random_name_generator. The shortcode accepts a btn_label attribute that defines the displayed button text. The plugin passes this attribute directly into the rendered HTML output without applying WordPress escaping functions such as esc_attr() or esc_html().

Because the shortcode value is persisted within post or page content, the payload is stored server-side and re-rendered each time the page loads. This makes the issue a stored XSS rather than a reflected one, increasing the practical impact. Each visitor to the affected page triggers the payload execution within the site's origin.

The attack requires authentication at the Contributor role or higher, which limits unauthenticated mass exploitation. However, sites that allow open registration of Contributor accounts or that grant Contributor access broadly remain exposed.

Root Cause

The root cause is missing input sanitization and missing output escaping on the btn_label shortcode parameter, as referenced in the plugin source at line 112 of orbisius-random-name-generator.php. Untrusted user input flows into a rendered HTML context without contextual encoding.

Attack Vector

An authenticated attacker with Contributor-level access creates or edits a post containing the orbisius_random_name_generator shortcode and supplies a malicious value for the btn_label attribute, such as an onerror handler or <script> payload. When an administrator previews the post, or when any user visits the published page, the JavaScript executes in the visitor's browser session.

The vulnerability has a scope change because the injected script runs in the security context of other users' browser sessions, including higher-privileged roles. See the Wordfence Vulnerability Report and the WordPress Plugin Code Version for technical references.

Detection Methods for CVE-2026-1893

Indicators of Compromise

Posts or pages containing the orbisius_random_name_generator shortcode with suspicious btn_label values that include <script>, onerror=, onload=, or javascript: substrings
Unexpected outbound HTTP requests from administrator browser sessions to attacker-controlled domains shortly after viewing post content
New or modified posts authored by low-privilege Contributor accounts that include shortcode attributes with HTML or JavaScript syntax

Detection Strategies

Query the wp_posts table for post_content matching the shortcode pattern combined with HTML or script syntax in the btn_label attribute
Review WordPress audit logs for Contributor-level accounts creating or editing posts that invoke the vulnerable shortcode
Inspect HTTP response bodies served from WordPress for unescaped <script> tags inside shortcode-rendered button markup

Monitoring Recommendations

Monitor administrator and editor session activity for anomalous DOM events, cookie reads, or REST API calls originating from post preview pages
Alert on creation of new Contributor accounts followed shortly by post submissions containing shortcodes
Track installed plugin versions across WordPress fleets and flag instances of Orbisius Random Name Generator at version 1.0.2 or earlier

How to Mitigate CVE-2026-1893

Immediate Actions Required

Disable or deactivate the Orbisius Random Name Generator plugin until a patched release is installed
Audit all posts and pages containing the orbisius_random_name_generator shortcode and remove any malicious btn_label values
Review Contributor-level accounts and revoke access for users that should not retain posting privileges
Force password resets for administrator accounts that previewed or edited content authored by untrusted contributors

Patch Information

Review the WordPress Plugin Change Log for the remediation commit. Update the plugin to the latest available version that applies esc_attr() to the btn_label shortcode attribute. Confirm the deployed plugin version is above 1.0.2 after upgrade.

Workarounds

Restrict shortcode usage by removing the orbisius_random_name_generator shortcode registration via a custom plugin or mu-plugin until patched
Apply a Web Application Firewall (WAF) rule that blocks POST requests to wp-admin/post.php containing shortcode attributes with <script or on*= patterns
Limit the Contributor role to trusted users and disable open user registration in WordPress general settings

bash

# Configuration example: disable open registration and remove the vulnerable shortcode
wp option update users_can_register 0
wp shell <<'EOF'
remove_shortcode( 'orbisius_random_name_generator' );
EOF