CVE-2026-1914: FuseDesk WordPress Plugin XSS Vulnerability

CVE-2026-1914 Overview

CVE-2026-1914 is a Stored Cross-Site Scripting (XSS) vulnerability in the FuseDesk plugin for WordPress. The flaw affects all versions up to and including 6.8. The vulnerability resides in the plugin's fusedesk_newcase shortcode, which fails to properly sanitize input and escape output on the emailtext attribute. Authenticated attackers with Contributor-level permissions or higher can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any user who visits the affected page. The weakness is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated contributors can inject persistent JavaScript that executes against site visitors and administrators, enabling session theft, account takeover, and privilege escalation paths.

Affected Products

FuseDesk plugin for WordPress, all versions up to and including 6.8
WordPress sites permitting Contributor-level or higher user registration
Pages or posts rendering the fusedesk_newcase shortcode

Discovery Timeline

2026-03-21 - CVE-2026-1914 published to NVD
2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-1914

Vulnerability Analysis

The FuseDesk plugin registers a shortcode named fusedesk_newcase that renders a support case submission form. The shortcode accepts an emailtext attribute used to populate form content. The plugin processes this attribute without applying WordPress sanitization functions such as esc_attr(), esc_html(), or wp_kses() before outputting it to the page. An attacker who places the shortcode with a malicious emailtext value into a post or page causes the payload to be stored in the database. The payload then executes each time a visitor loads the rendered page.

Contributors in WordPress can create draft posts and edit their own content. This privilege level is sufficient to embed the vulnerable shortcode with attacker-controlled attributes. Because the script executes in the context of the site origin, it can read cookies not marked HttpOnly, perform authenticated actions on behalf of the viewer, and target administrators who preview contributor submissions.

Root Cause

The root cause is insufficient input sanitization and missing output escaping on the emailtext shortcode attribute in fusedesk.php around line 561. The plugin trusts user-supplied attribute values and writes them directly into HTML output. Refer to the WordPress Plugin Source Code for the affected function.

Attack Vector

Exploitation requires an authenticated account with at least Contributor privileges. The attacker creates or edits a post containing the fusedesk_newcase shortcode with a crafted emailtext attribute carrying JavaScript. When a victim views the post, the browser parses and executes the injected script under the site's origin. The scope change in the CVSS vector reflects that the impact crosses from the vulnerable plugin into the broader browser context of other users. See the Wordfence Vulnerability Analysis for additional technical detail.

Detection Methods for CVE-2026-1914

Indicators of Compromise

Posts or pages containing the [fusedesk_newcase] shortcode with unusual emailtext attribute values containing HTML tags, <script>, onerror=, or javascript: payloads
Unexpected outbound requests from administrator browsers to attacker-controlled domains after viewing contributor content
New administrator accounts or modified user roles following review of pending contributor posts

Detection Strategies

Audit the wp_posts table for shortcode invocations referencing fusedesk_newcase and inspect attribute contents for script tags or event handlers
Review web server access logs for anomalous POST requests to /wp-admin/post.php from Contributor accounts followed by GET requests rendering the affected pages
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution originating from plugin-rendered content

Monitoring Recommendations

Monitor WordPress audit logs for Contributor account creation, role changes, and post submissions containing shortcodes
Alert on administrative sessions accessing contributor draft previews shortly after new submissions
Track plugin version inventory across WordPress installations and flag any host still running FuseDesk 6.8 or earlier

How to Mitigate CVE-2026-1914

Immediate Actions Required

Update the FuseDesk plugin to a version newer than 6.8 once the vendor publishes a fix
Restrict Contributor account registration and review existing accounts for unauthorized users
Scan all posts and pages for the fusedesk_newcase shortcode and inspect attribute values for malicious content

Patch Information

At the time of NVD publication, the affected releases include all FuseDesk plugin versions up to and including 6.8. Administrators should monitor the FuseDesk plugin repository and the Wordfence advisory for the patched release and apply it across all WordPress installations.

Workarounds

Deactivate the FuseDesk plugin until a patched version is available if support case functionality is not business critical
Apply a Web Application Firewall (WAF) rule that blocks requests containing fusedesk_newcase shortcodes with HTML tags or event handlers in the emailtext parameter
Reduce contributor privileges or require editorial review of all contributor posts before they become visible to other users
Enforce a strict Content Security Policy that disallows inline script execution to limit XSS payload impact

bash

# Example WordPress WP-CLI commands to audit and disable the plugin
wp plugin list --name=fusedesk --fields=name,status,version
wp post list --post_status=any --format=ids | xargs -I {} wp post get {} --field=post_content | grep -l 'fusedesk_newcase'
wp plugin deactivate fusedesk