CVE-2026-1903: Ravelry Designs Widget XSS Vulnerability

CVE-2026-1903 Overview

CVE-2026-1903 is a Stored Cross-Site Scripting (XSS) vulnerability in the Ravelry Designs Widget plugin for WordPress. The flaw affects all versions up to and including 1.0.0. It exists in the layout attribute of the sb_ravelry_designs shortcode, which lacks proper input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. The injected scripts execute in the browser of any user who views the affected page. The vulnerability is tracked under CWE-79, Improper Neutralization of Input During Web Page Generation.

Critical Impact
Contributor-level users can persist JavaScript payloads that execute against site visitors and administrators, enabling session theft, content manipulation, and account takeover.

Affected Products

Ravelry Designs Widget plugin for WordPress, versions ≤ 1.0.0
WordPress sites permitting contributor-level user registration
WordPress installations exposing the sb_ravelry_designs shortcode

Discovery Timeline

2026-02-14 - CVE-2026-1903 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-1903

Vulnerability Analysis

The Ravelry Designs Widget plugin registers a WordPress shortcode named sb_ravelry_designs. The shortcode accepts a layout attribute that controls rendering. The plugin echoes the attribute value into the HTML response without applying output escaping functions such as esc_attr() or esc_html(). It also fails to sanitize the value on input. An authenticated attacker with the contributor role or higher can submit a post or page containing the shortcode with a crafted layout value. The payload is stored in the WordPress database. When the page is rendered, the unsanitized attribute reaches the browser and executes as JavaScript in the visitor's session context.

Root Cause

The root cause is missing input validation and missing output encoding on shortcode attributes. WordPress shortcode attributes are user-controlled strings that must be treated as untrusted. The vulnerable code path at line 119 of ravelry-designs-widget.php concatenates the layout attribute directly into the response markup. No allowlist of valid layout values is enforced.

Attack Vector

An authenticated attacker with at least contributor privileges creates or edits a post containing the malicious shortcode. The attacker sets the layout attribute to a value that breaks out of its HTML context and injects a <script> tag or event handler. Once the post is published or previewed, the script executes in the browser of every viewer, including administrators. This enables session hijacking, forced administrative actions, and cross-site request forgery against authenticated sessions.

No verified public proof-of-concept code is available. Refer to the Wordfence Vulnerability Analysis and the WordPress Plugin Source Code for the vulnerable code path.

Detection Methods for CVE-2026-1903

Indicators of Compromise

Posts or pages containing [sb_ravelry_designs] shortcodes with layout attribute values containing HTML tags, quotes, or JavaScript keywords such as script, onerror, or onload
Unexpected outbound requests from visitor browsers to attacker-controlled domains after rendering plugin-enabled pages
New or modified administrator accounts following contributor activity

Detection Strategies

Query the wp_posts table for post_content matching the sb_ravelry_designs shortcode with suspicious layout attribute values
Review WordPress audit logs for contributor-level users creating or editing posts containing shortcodes
Inspect rendered HTML responses for unescaped <script> tags within plugin-generated markup

Monitoring Recommendations

Enable a Web Application Firewall (WAF) ruleset that blocks XSS payloads in WordPress POST requests to /wp-admin/post.php
Monitor browser Content Security Policy (CSP) violation reports for inline script execution on pages using the plugin
Track privilege changes and unusual administrative actions following contributor account activity

How to Mitigate CVE-2026-1903

Immediate Actions Required

Deactivate and remove the Ravelry Designs Widget plugin until a patched version is released
Audit all contributor and author accounts and remove any that are unrecognized or inactive
Review existing posts and pages for the sb_ravelry_designs shortcode and remove or sanitize any suspicious layout attribute values

Patch Information

At the time of publication, no patched version of the Ravelry Designs Widget plugin has been released. All versions up to and including 1.0.0 are affected. Site administrators should monitor the WordPress Plugin Repository for an updated release and the Wordfence Vulnerability Analysis for remediation guidance.

Workarounds

Restrict the contributor role from using shortcodes by applying a remove_shortcode('sb_ravelry_designs') filter for non-administrative roles
Deploy a Content Security Policy (CSP) header that disallows inline scripts and restricts script sources to trusted origins
Require manual administrator review of all contributor-submitted content before publication

bash

# Configuration example: deactivate the vulnerable plugin via WP-CLI
wp plugin deactivate ravelry-designs-widget
wp plugin delete ravelry-designs-widget

# Search the database for potentially malicious shortcode usage
wp db query "SELECT ID, post_title, post_author FROM wp_posts WHERE post_content LIKE '%sb_ravelry_designs%' AND post_content LIKE '%layout=%';"