CVE-2026-22524: Legacy Admin Reflected XSS Vulnerability

CVE-2026-22524 Overview

CVE-2026-22524 is a reflected cross-site scripting (XSS) vulnerability in the themepassion Legacy Admin WordPress plugin. The flaw affects all versions of legacy-admin up to and including version 9.5. The vulnerability stems from improper neutralization of user-supplied input during web page generation, classified under [CWE-79]. Attackers can craft malicious URLs that execute arbitrary JavaScript in the browser of any victim who clicks the link. The scope-changed Common Vulnerability Scoring System (CVSS) vector indicates the payload can affect resources beyond the vulnerable component, including the authenticated WordPress session.

Critical Impact
Successful exploitation enables session theft, administrative action hijacking, and phishing against WordPress site administrators through a single crafted link.

Affected Products

themepassion Legacy Admin WordPress plugin (legacy-admin)
All versions from initial release through 9.5
WordPress installations with the plugin active

Discovery Timeline

2026-03-25 - CVE-2026-22524 published to the National Vulnerability Database (NVD)
2026-04-24 - Last updated in NVD database

Technical Details for CVE-2026-22524

Vulnerability Analysis

The Legacy Admin plugin reflects user-controlled input into HTML responses without proper sanitization or output encoding. An attacker constructs a URL containing JavaScript payloads embedded in a vulnerable parameter. When a victim clicks the link, the server returns a page that includes the unescaped payload, and the browser executes it within the WordPress origin.

The vulnerability requires user interaction, as indicated by the attack vector requiring a victim to follow a crafted link. The scope change reflects that injected scripts can act beyond the plugin context, accessing cookies, session tokens, and the broader WordPress admin interface. Confidentiality, integrity, and availability impacts are each rated low, since attackers operate within the victim's browser permissions.

Root Cause

The root cause is missing input neutralization in request handlers that echo parameter values back to the response. The plugin fails to apply WordPress sanitization helpers such as esc_html(), esc_attr(), or wp_kses() before rendering user-supplied data into HTML output.

Attack Vector

The attacker delivers the malicious URL through phishing emails, forum posts, or third-party sites. When an authenticated WordPress administrator visits the crafted link, the reflected payload executes in their session. The script can exfiltrate authentication cookies, submit privileged forms via cross-site request forgery, create rogue administrator accounts, or inject persistent backdoors into theme and plugin files. Refer to the Patchstack WordPress Vulnerability advisory for technical details.

Detection Methods for CVE-2026-22524

Indicators of Compromise

Inbound HTTP requests to Legacy Admin plugin endpoints containing URL-encoded <script>, onerror=, onload=, or javascript: payloads
Unexpected administrator account creation or role changes following an admin click on an external link
Modified theme or plugin files containing obfuscated JavaScript or PHP web shells
Outbound requests from administrator browsers to unknown domains immediately after WordPress admin login

Detection Strategies

Inspect web server access logs for requests targeting legacy-admin paths with suspicious query string content
Deploy a web application firewall (WAF) with signatures for reflected XSS patterns against WordPress plugin endpoints
Monitor WordPress audit logs for privilege changes and option modifications that correlate with administrator browsing activity
Correlate referrer headers showing external sources with administrator session activity in the wp-admin interface

Monitoring Recommendations

Forward WordPress, web server, and WAF logs to a centralized analytics platform for correlation
Alert on new administrator account creation outside of approved change windows
Track file integrity changes in wp-content/plugins/ and wp-content/themes/ directories
Review browser security headers and enforce Content Security Policy (CSP) violation reporting endpoints

How to Mitigate CVE-2026-22524

Immediate Actions Required

Disable or deactivate the Legacy Admin plugin until a patched version is available
Audit WordPress user accounts for unauthorized administrator additions or role escalations
Force a password reset and session invalidation for all administrator accounts
Restrict access to /wp-admin/ by IP address where operationally feasible

Patch Information

No fixed version is identified in the advisory at the time of publication. The vulnerability affects all versions through 9.5. Monitor the Patchstack advisory and the WordPress plugin repository for an updated release from themepassion.

Workarounds

Remove the Legacy Admin plugin entirely if it is not business-critical
Deploy a WAF rule blocking requests to plugin endpoints containing HTML or JavaScript metacharacters in query parameters
Enforce a strict Content Security Policy that disallows inline script execution in the WordPress admin interface
Train administrators to avoid clicking untrusted links while logged into WordPress

bash

# Example WAF rule (ModSecurity) blocking script payloads on legacy-admin endpoints
SecRule REQUEST_URI "@contains /wp-content/plugins/legacy-admin/" \
    "chain,deny,status:403,id:1026022524,msg:'Blocked reflected XSS attempt against Legacy Admin (CVE-2026-22524)'"
    SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:)" "t:urlDecodeUni"