CVE-2026-1912: Citations Tools WordPress Plugin XSS Flaw

CVE-2026-1912 Overview

The Citations Tools plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the code parameter of the ctdoi shortcode. All versions up to and including 0.3.2 are affected due to insufficient input sanitization and output escaping on user-supplied attributes. This vulnerability allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages that execute whenever a user accesses an injected page.

Critical Impact

Authenticated attackers can persistently inject malicious scripts that execute in the browsers of all users who view affected pages, potentially leading to session hijacking, credential theft, or malware distribution.

Affected Products

• Citations Tools WordPress Plugin versions up to and including 0.3.2
• WordPress sites with Contributor-level user access enabled

Discovery Timeline

• 2026-02-14 - CVE CVE-2026-1912 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-1912

Vulnerability Analysis

This vulnerability falls under CWE-79 (Cross-Site Scripting), specifically the Stored XSS variant. The Citations Tools plugin fails to properly sanitize and escape the code parameter within the ctdoi shortcode handler before rendering it to the page. When a user with at least Contributor-level privileges creates or edits content containing a malicious ctdoi shortcode, the injected payload is stored in the WordPress database and subsequently executed in the browser of any visitor viewing that page.

The attack requires network access and authentication with at least Contributor privileges, but no user interaction is needed beyond accessing the compromised page. The vulnerability has a changed scope, meaning the malicious script can affect resources beyond the vulnerable component itself.

Root Cause

The root cause lies in the plugin's shortcode processing function located in citations-tools.php. The code parameter is accepted from user input and rendered directly into the page output without proper sanitization using WordPress functions such as esc_attr(), esc_html(), or wp_kses(). This allows arbitrary HTML and JavaScript code to be embedded within the shortcode and persisted in the database.

Attack Vector

The attack is network-based and requires an authenticated attacker with at least Contributor-level access to the WordPress installation. The attacker creates a post or page containing a crafted ctdoi shortcode with malicious JavaScript embedded in the code parameter. Once the content is saved, any user visiting the page—including administrators—will have the malicious script execute in their browser context.

The malicious payload persists in the WordPress database, making this a Stored XSS attack that can affect multiple victims over time without requiring further attacker interaction.

Detection Methods for CVE-2026-1912

Indicators of Compromise

• Unusual or unexpected JavaScript code within post content containing ctdoi shortcodes
• Database entries in wp_posts table containing suspicious script tags or event handlers within shortcode parameters
• Browser developer tools showing execution of scripts from unexpected origins on pages with Citations Tools shortcodes

Detection Strategies

• Review all posts and pages for ctdoi shortcodes with unusual code parameter values containing HTML tags or JavaScript
• Implement Content Security Policy (CSP) headers to detect and block inline script execution
• Deploy web application firewall (WAF) rules to flag XSS patterns in shortcode parameters
• Monitor WordPress user activity logs for Contributor-level users creating content with suspicious shortcode syntax

Monitoring Recommendations

• Enable comprehensive logging for WordPress content creation and modification events
• Configure real-time alerting for posts containing potential XSS payloads in shortcode attributes
• Regularly audit the Citations Tools plugin shortcode usage across all site content

How to Mitigate CVE-2026-1912

Immediate Actions Required

• Review and update the Citations Tools plugin to a patched version if available
• Audit all existing posts and pages for potentially malicious ctdoi shortcodes
• Restrict Contributor-level access until the vulnerability is remediated
• Consider temporarily disabling the Citations Tools plugin if it is not critical to site operations

Patch Information

Refer to the WordPress Plugin Code Review for technical details on the vulnerable code location. Additional vulnerability information is available in the Wordfence Vulnerability Report.

Organizations should monitor the WordPress plugin repository for an updated version that addresses this vulnerability. Until a patch is available, implement the workarounds described below.

Workarounds

• Disable the Citations Tools plugin until a security update is released
• Restrict WordPress user roles to prevent untrusted users from having Contributor-level or higher access
• Implement server-side input validation to filter potentially malicious shortcode parameters
• Deploy a Web Application Firewall (WAF) with XSS detection rules to block malicious payloads

# WordPress configuration to restrict shortcode usage
# Add to wp-config.php or functions.php to remove the vulnerable shortcode
remove_shortcode('ctdoi');