CVE-2026-1910: UpMenu WordPress Plugin XSS Vulnerability

CVE-2026-1910 Overview

The UpMenu – Online ordering for restaurants plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the 'lang' attribute of the 'upmenu-menu' shortcode. This vulnerability exists in all versions up to and including 3.1 due to insufficient input sanitization and output escaping on user-supplied attributes. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages that execute whenever a user accesses the compromised page.

Critical Impact

Authenticated attackers can inject persistent malicious scripts that execute in victims' browsers, potentially leading to session hijacking, credential theft, defacement, or malware distribution targeting site visitors.

Affected Products

• UpMenu – Online ordering for restaurants plugin for WordPress versions up to and including 3.1
• WordPress sites using vulnerable versions of the UpMenu plugin
• Restaurant websites with the upmenu-menu shortcode implementation

Discovery Timeline

• 2026-02-14 - CVE-2026-1910 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-1910

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability stems from improper handling of the lang attribute within the upmenu-menu shortcode functionality. When processing shortcode attributes, the plugin fails to properly sanitize user input before storing it and neglects to escape output when rendering the attribute value in page content. This creates a persistent XSS vector where malicious JavaScript code injected through the lang parameter remains stored in the WordPress database and executes each time a user views a page containing the compromised shortcode.

The attack requires contributor-level authentication, which represents a relatively low privilege threshold in WordPress environments. Contributors can create posts and use shortcodes but cannot publish without approval. However, malicious content injected via this vulnerability persists in draft posts and executes upon preview or publication by higher-privileged users, expanding the attack surface.

Root Cause

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability originates at line 720 in upmenu.php where the plugin processes the lang attribute from the shortcode without adequate validation. The plugin directly incorporates user-controlled attribute values into the HTML output without applying proper escaping functions such as esc_attr() or esc_html(), allowing script injection through crafted attribute values.

Attack Vector

The attack is network-accessible with low complexity requirements. An authenticated attacker with contributor-level access creates or edits a post containing the upmenu-menu shortcode with a malicious payload in the lang attribute. The payload could include JavaScript event handlers or script tags disguised within the attribute value.

When the page is rendered—whether during preview by an editor, upon publication, or when viewed by site visitors—the injected script executes in the context of the victim's browser session. This enables session token theft, keylogging, phishing overlay injection, or redirects to malicious sites. The changed scope indicator in the vulnerability assessment reflects that successful exploitation can impact resources beyond the vulnerable component itself.

For technical implementation details, refer to the WordPress Plugin Code Reference and the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-1910

Indicators of Compromise

• Presence of unusual JavaScript code or event handlers within upmenu-menu shortcode lang attributes in post content
• Posts or pages containing encoded or obfuscated script payloads in shortcode parameters
• Unexpected network requests originating from restaurant menu pages to external domains
• User reports of browser warnings, unexpected redirects, or suspicious behavior on pages containing UpMenu shortcodes

Detection Strategies

• Review WordPress database wp_posts table for upmenu-menu shortcodes containing suspicious lang attribute values including <script>, javascript:, or event handlers like onerror, onload, onclick
• Implement Content Security Policy (CSP) headers to detect and block inline script execution attempts
• Deploy web application firewall (WAF) rules to identify XSS patterns in shortcode attribute values
• Enable WordPress audit logging to track shortcode modifications by contributor-level users

Monitoring Recommendations

• Monitor for unusual post edits by contributor accounts, particularly those modifying shortcode attributes
• Track JavaScript errors or CSP violation reports that may indicate blocked XSS attempts
• Review web server access logs for pages containing UpMenu functionality being accessed following suspicious edit activity
• Implement real-time alerting for database modifications to posts containing the upmenu-menu shortcode

How to Mitigate CVE-2026-1910

Immediate Actions Required

• Update the UpMenu plugin to a patched version that addresses the input sanitization vulnerability
• Audit existing content for malicious payloads in upmenu-menu shortcode lang attributes and remove any suspicious code
• Temporarily restrict contributor access or disable the ability to use the upmenu-menu shortcode until patching is complete
• Implement a Web Application Firewall (WAF) with XSS protection rules as an additional defense layer

Patch Information

Monitor the official WordPress plugin repository and vendor channels for security updates addressing CVE-2026-1910. The vulnerability affects versions up to and including 3.1, so ensure you update to a version higher than 3.1 once a patch is released. Verify the update includes proper sanitization of the lang attribute using WordPress escaping functions.

For tracking patch availability, review the WordPress Plugin Development File for code changes addressing the sanitization issue.

Workarounds

• Remove or disable the UpMenu plugin until a patched version is available if it is not critical to operations
• Implement server-side input validation for shortcode attributes using a security plugin or custom code filter
• Deploy Content Security Policy headers with strict script-src directives to mitigate script execution impact
• Restrict contributor role capabilities to prevent shortcode usage in posts pending patch deployment

# Example CSP header configuration for Apache
# Add to .htaccess or virtual host configuration
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';"

# For Nginx, add to server block
# add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';";