CVE-2026-1913: Gallagher Website Design Plugin XSS Flaw

CVE-2026-1913 Overview

The Gallagher Website Design plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the plugin's login_link shortcode in all versions up to and including 2.6.4. The vulnerability exists due to insufficient input sanitization and output escaping on the prefix attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Critical Impact

Authenticated attackers with Contributor-level access can inject persistent malicious scripts that execute in the browsers of all users viewing affected pages, potentially leading to session hijacking, credential theft, or malware distribution.

Affected Products

• Gallagher Website Design plugin for WordPress versions up to and including 2.6.4
• WordPress installations using the vulnerable plugin's login_link shortcode functionality

Discovery Timeline

• 2026-04-22 - CVE-2026-1913 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-1913

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability stems from the improper handling of user-supplied input within the login_link shortcode functionality. The plugin fails to adequately sanitize input and escape output for the prefix attribute, creating an injection point for malicious JavaScript code.

When a user with at least Contributor-level privileges creates or edits content containing the login_link shortcode, they can craft a malicious prefix attribute value containing JavaScript payloads. Because the vulnerability is stored (persistent), the malicious script is saved to the database and executes every time any user views the affected page. This is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Root Cause

The root cause of this vulnerability is insufficient input sanitization and output escaping in the shortcode handler function located at line 203 of gallagher-website-design.php. The prefix attribute passed to the login_link shortcode is rendered in the HTML output without proper escaping, allowing HTML and JavaScript injection. WordPress provides functions like esc_attr(), esc_html(), and wp_kses() specifically for sanitizing shortcode attributes, but these were not properly implemented for the prefix parameter.

Attack Vector

The attack requires network access and authentication with at least Contributor-level privileges on the WordPress installation. An attacker exploits this vulnerability by:

1. Authenticating to WordPress with Contributor or higher privileges
2. Creating or editing a post/page containing the login_link shortcode
3. Injecting malicious JavaScript in the prefix attribute
4. Publishing or submitting the content for review
5. Waiting for victims (including administrators) to view the page

The malicious script then executes in the context of the victim's browser session, potentially allowing the attacker to steal session cookies, perform actions on behalf of the victim, or redirect users to malicious sites.

The vulnerability is exploited through the login_link shortcode's prefix attribute. An attacker with Contributor-level access can craft a shortcode with malicious JavaScript embedded in the prefix parameter. When the page renders, the unsanitized prefix value is output directly into the HTML, causing the injected script to execute in visitors' browsers. For detailed technical analysis, see the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2026-1913

Indicators of Compromise

• Unusual JavaScript code or HTML tags in post/page content containing login_link shortcodes
• Unexpected script execution or browser redirects when viewing pages with login links
• Database entries in wp_posts containing suspicious prefix attribute values with encoded script tags
• Reports from users experiencing unexpected behavior when viewing specific pages

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect XSS patterns in shortcode attributes
• Monitor WordPress database for posts containing login_link shortcodes with suspicious prefix values
• Review content submitted by Contributor-level users for malicious script patterns
• Deploy browser-based XSS detection through Content Security Policy (CSP) violation reporting

Monitoring Recommendations

• Enable WordPress activity logging to track shortcode usage and content modifications by Contributors
• Implement Content Security Policy headers to detect and report inline script execution attempts
• Monitor server logs for unusual patterns of page access following content updates
• Configure SentinelOne Singularity to detect browser-based attack indicators and JavaScript injection patterns

How to Mitigate CVE-2026-1913

Immediate Actions Required

• Update the Gallagher Website Design plugin to the latest patched version immediately
• Audit all existing content for malicious login_link shortcode usage with suspicious prefix attributes
• Review user accounts with Contributor-level access for potential compromise
• Consider temporarily disabling the shortcode functionality until patching is complete

Patch Information

A security patch has been released to address this vulnerability. The fix involves implementing proper input sanitization and output escaping for the prefix attribute in the login_link shortcode handler. Technical details of the changes can be reviewed in the WordPress Changeset Overview. Update via the WordPress admin dashboard or download the latest version from the WordPress plugin repository.

Workarounds

• Restrict Contributor-level user access until the plugin is updated
• Implement server-side input filtering to strip potentially malicious content from shortcode attributes
• Deploy a Web Application Firewall with XSS protection rules enabled
• Add Content Security Policy headers to prevent inline script execution as a defense-in-depth measure

# Configuration example - Add CSP headers to WordPress via .htaccess
<IfModule mod_headers.c>
    Header set Content-Security-Policy "script-src 'self'; object-src 'none';"
    Header set X-XSS-Protection "1; mode=block"
    Header set X-Content-Type-Options "nosniff"
</IfModule>