CVE-2026-1905: Sphere Manager WordPress Plugin XSS Flaw

CVE-2026-1905 Overview

CVE-2026-1905 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Sphere Manager plugin for WordPress. The flaw exists in the show_sphere_image shortcode, where the width parameter is processed without sufficient input sanitization or output escaping. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript that executes in the browser of any visitor viewing the affected page. The vulnerability is tracked under [CWE-79] and impacts all versions up to and including 1.0.2.

Critical Impact
Authenticated contributors can persist malicious scripts in WordPress pages, enabling session theft, credential harvesting, and administrative account takeover when privileged users visit injected content.

Affected Products

Sphere Manager plugin for WordPress, all versions through 1.0.2
WordPress sites permitting Contributor-level registration or higher
Pages and posts rendering the show_sphere_image shortcode

Discovery Timeline

2026-02-14 - CVE-2026-1905 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-1905

Vulnerability Analysis

The Sphere Manager plugin exposes the show_sphere_image shortcode to authenticated content authors. The shortcode accepts a width attribute intended to control image dimensions. The plugin reflects the supplied width value directly into the rendered HTML output without sanitizing input or escaping output. An attacker supplies a crafted attribute value that breaks out of the HTML attribute context and introduces script content. The injected payload persists in the database as part of the post content and executes on every subsequent page view.

Root Cause

The root cause is a failure to apply WordPress sanitization helpers such as esc_attr() or absint() to the width shortcode parameter before insertion into the response body. Numeric values should be cast or validated, but the plugin handler concatenates the raw string into HTML at the location referenced in the plugin source at plugin.php line 232. This pattern matches the textbook conditions for stored XSS described in [CWE-79].

Attack Vector

Exploitation requires authenticated access at Contributor level or higher. The attacker creates or edits a post containing the show_sphere_image shortcode with a malicious width value. After the content is saved and viewed, the payload executes in the visitor's session context. The scope is changed because the attack crosses from the attacker's authoring privileges into the security context of higher-privileged viewers, including administrators.

The vulnerability is described in prose because no public proof-of-concept code has been verified. Technical context is available in the Wordfence Vulnerability Report and the WordPress Plugin Code Review.

Detection Methods for CVE-2026-1905

Indicators of Compromise

Post or page content containing show_sphere_image shortcode with non-numeric width attribute values
Database entries in wp_posts.post_content containing <script>, onerror, or onload strings adjacent to show_sphere_image
Unexpected outbound requests from visitor browsers to attacker-controlled domains after viewing pages

Detection Strategies

Query the WordPress database for posts referencing show_sphere_image and inspect attribute values for HTML metacharacters
Review web server access logs for Contributor-account post submissions containing encoded <, >, or quote characters
Apply Web Application Firewall rules that flag shortcode parameters carrying script-like payloads

Monitoring Recommendations

Audit user role assignments and flag Contributor accounts created from untrusted sources
Monitor browser-side telemetry for anomalous script execution on WordPress front-end pages
Alert on modifications to published posts that introduce shortcode attribute values containing HTML markup

How to Mitigate CVE-2026-1905

Immediate Actions Required

Disable or uninstall the Sphere Manager plugin until a patched release becomes available
Audit existing posts for malicious show_sphere_image shortcode usage and remove injected payloads
Restrict new Contributor-level registrations and review existing low-privilege accounts

Patch Information

No patched version has been published at the time of NVD entry. All versions up to and including 1.0.2 remain vulnerable. Site operators should monitor the WordPress Plugin Development Version for fixes addressing input sanitization on the width parameter.

Workarounds

Remove the show_sphere_image shortcode from active templates and posts
Deploy a WordPress security plugin or WAF ruleset that blocks script content in shortcode attributes
Limit shortcode usage to administrator roles via custom capability filters until a fix ships

bash

# Identify posts containing the vulnerable shortcode
wp post list --field=ID --post_status=any \
  | xargs -I {} wp post get {} --field=post_content \
  | grep -l "show_sphere_image"

# Deactivate the plugin via WP-CLI
wp plugin deactivate sphere-manager