CVE-2026-2281: Private Comment Plugin for WordPress XSS

CVE-2026-2281 Overview

CVE-2026-2281 is a stored cross-site scripting (XSS) vulnerability in the Private Comment plugin for WordPress, affecting all versions up to and including 0.0.4. The flaw resides in the plugin's Label text setting, where insufficient input sanitization and output escaping allow authenticated attackers to inject arbitrary JavaScript. Successful exploitation requires Administrator-level access and only impacts multi-site installations or environments where unfiltered_html has been disabled. Injected payloads execute in the browsers of users viewing affected pages. The vulnerability is classified under CWE-79.

Critical Impact
Authenticated administrators on multi-site WordPress deployments can inject persistent JavaScript that executes against any visitor of affected pages, enabling session theft and privileged action abuse.

Affected Products

WordPress Private Comment plugin versions 0.0.1 through 0.0.4
WordPress multi-site installations running the affected plugin
WordPress installations where the unfiltered_html capability has been disabled

Discovery Timeline

2026-02-18 - CVE-2026-2281 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-2281

Vulnerability Analysis

The Private Comment plugin exposes a Label text configuration option that administrators can customize through the plugin settings. The plugin stores this value in the WordPress options table and renders it back into page output without applying proper escaping routines such as esc_html() or esc_attr(). An attacker who controls an administrator account can therefore embed <script> tags or event-handler attributes that are persisted and executed each time a page renders the label.

Because the payload is stored server-side, every subsequent visitor to an affected page triggers the script. The attack changes the security scope, allowing the injected code to affect users beyond the configuration interface, which is reflected in the scope-changed nature of the issue. The CWE-79 classification aligns with classic stored XSS through missing output encoding.

Root Cause

The root cause is the absence of input sanitization on save and output escaping on render for the label option. The vulnerable code path is documented in the plugin source at line 128 of private-comment.php, visible in the WordPress Plugin File Version and the WordPress Plugin Development Version. The fix is recorded in WordPress Changeset #3458294.

Attack Vector

The attack requires network access to the WordPress administration interface and valid Administrator credentials. The attacker navigates to the Private Comment settings, supplies a malicious string in the Label text field, and saves the configuration. The payload then executes against any user who loads a page that renders the label, including site visitors and other administrators. The constraint on Administrator privilege limits the practical attack surface to multi-site environments where subordinate site admins lack the unfiltered_html capability that super admins retain.

No verified exploit code is published. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-2281

Indicators of Compromise

Presence of <script>, javascript:, or HTML event-handler attributes (for example onerror=, onload=) inside the private_comment_label option value stored in wp_options.
Unexpected modifications to Private Comment plugin settings recorded in WordPress audit logs.
Outbound browser requests from site visitors to attacker-controlled domains referenced inside rendered page content.

Detection Strategies

Query the WordPress database for label option values that contain HTML tag characters or JavaScript schemes and review them for legitimacy.
Inspect rendered HTML of pages that include the Private Comment label for unexpected inline scripts or attribute-based handlers.
Correlate administrator login events with subsequent changes to plugin option values to detect compromised administrator accounts performing injection.

Monitoring Recommendations

Enable WordPress activity logging to capture option updates, plugin setting changes, and administrator authentication events.
Forward web server logs and WordPress audit events to a centralized log platform and alert on options.php POST requests targeting plugin settings.
Monitor Content Security Policy (CSP) violation reports for inline-script execution on pages rendering plugin labels.

How to Mitigate CVE-2026-2281

Immediate Actions Required

Update the Private Comment plugin to a version that includes the fix from WordPress Changeset #3458294.
Audit the Label text setting in every site of any multi-site installation and remove any HTML or script content.
Review administrator accounts on multi-site networks, rotate credentials, and enforce multi-factor authentication for privileged users.

Patch Information

The vendor addressed the issue after version 0.0.4 by introducing proper sanitization and escaping on the label option. Site operators should apply the latest plugin release available through the WordPress plugin repository. Confirm the deployed version is greater than 0.0.4 and verify the patched code path referenced in the changeset.

Workarounds

Deactivate the Private Comment plugin until the patched version can be installed.
Restrict administrator access on multi-site networks and limit who can modify plugin settings.
Deploy a Content Security Policy that disallows inline scripts to reduce the impact of stored XSS payloads.
Re-enable the unfiltered_html capability only for trusted super administrators where operationally acceptable.

bash

# Verify the installed Private Comment plugin version using WP-CLI
wp plugin get private-comment --field=version

# Force update to the latest patched release
wp plugin update private-comment

# Inspect the stored label option for suspicious content
wp option get private_comment_label