CVE-2026-2288: WordPress myLinksDump Plugin XSS Flaw

CVE-2026-2288 Overview

CVE-2026-2288 is a Stored Cross-Site Scripting (XSS) vulnerability in the myLinksDump plugin for WordPress, affecting all versions up to and including 1.6. The flaw resides in the handling of the link_title parameter, where insufficient input sanitization and output escaping allow authenticated administrators to inject arbitrary JavaScript. Injected scripts execute in the browser context of any user who views an affected page. The vulnerability only impacts WordPress multi-site installations and single-site installations where the unfiltered_html capability has been disabled. The weakness is tracked as [CWE-79].

Critical Impact
Authenticated administrator-level attackers can inject persistent JavaScript that executes against site visitors, enabling session theft, content manipulation, or pivoting to higher-privileged super-admin accounts on multi-site networks.

Affected Products

myLinksDump WordPress plugin versions <= 1.6
WordPress multi-site installations using the plugin
WordPress installations where unfiltered_html is disabled

Discovery Timeline

2026-05-27 - CVE-2026-2288 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-2288

Vulnerability Analysis

The myLinksDump plugin accepts user-controlled input through the link_title parameter and stores it in the WordPress database. When the stored content is rendered back to administrators or end users, the plugin fails to apply proper output escaping. Any HTML or JavaScript embedded in the parameter is rendered as live markup in the browser. Because the payload persists in storage, it executes for every visitor to the injected page until it is removed.

The issue is gated by privilege requirements. Only authenticated users with administrator-level access or higher can reach the vulnerable input handler. On standard single-site WordPress installations, administrators already hold the unfiltered_html capability, making this behavior expected rather than a privilege boundary violation. The flaw becomes a security boundary issue on multi-site networks, where individual site administrators do not have unfiltered_html by default — only super administrators do. A site admin can therefore inject scripts that execute against the super admin, enabling cross-tenant compromise.

Root Cause

The plugin does not sanitize the link_title value with WordPress functions such as wp_kses_post() or sanitize_text_field() before storage, and does not escape it with esc_html() or esc_attr() during output. The vulnerable code paths are referenced at lines 325 and 557 of myLinksDump.php. See the WordPress Plugin Trac source for tag 1.6 and the Wordfence Vulnerability Analysis for the affected line references.

Attack Vector

An attacker with administrator privileges on a child site within a WordPress multi-site network submits a link_title value containing a JavaScript payload such as an <script> tag or an event handler attribute. The payload is written to the database without sanitization. When a super administrator or other user with broader privileges loads the page that renders the title, the script executes in their browser session. The attacker can use this to issue authenticated requests, exfiltrate cookies that are not marked HttpOnly, or escalate privileges across the network.

The vulnerability requires network access, low attack complexity, high privileges, and user interaction to trigger the stored payload. No public proof-of-concept or in-the-wild exploitation has been reported.

Detection Methods for CVE-2026-2288

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or DOM event handlers (onerror, onload) in WordPress post or page content stored by myLinksDump.
Outbound HTTP requests from admin browser sessions to unfamiliar domains shortly after viewing plugin-rendered pages.
New or modified administrator or super-administrator accounts created without a corresponding audit trail.

Detection Strategies

Query the wp_posts and plugin-specific tables for stored link_title values containing <, >, script, or on*= substrings.
Inspect WordPress audit logs for link_title edits performed by site administrators on multi-site networks.
Compare installed myLinksDump versions against the affected range <= 1.6 across all sites in a network.

Monitoring Recommendations

Enable a Web Application Firewall (WAF) rule set that flags stored XSS payloads in WordPress admin POST requests.
Forward WordPress and web-server logs to a centralized analytics platform to correlate administrator activity with anomalous page renders.
Monitor browser Content Security Policy (CSP) violation reports to identify inline script execution from plugin-rendered pages.

How to Mitigate CVE-2026-2288

Immediate Actions Required

Disable or remove the myLinksDump plugin on all multi-site networks and any single-site installation where unfiltered_html has been revoked from administrators.
Audit existing link_title values across all sites and remove any entries containing HTML or JavaScript markup.
Review recent administrator account changes and active sessions on multi-site networks, and force re-authentication for super administrators.

Patch Information

At the time of publication, no fixed version of the myLinksDump plugin beyond 1.6 is referenced in the available advisories. Site operators should monitor the WordPress.org plugin repository and the Wordfence Vulnerability Analysis for an updated release that adds sanitization on input and escaping on output for the link_title parameter.

Workarounds

Restrict administrator privileges on multi-site networks to trusted operators only, since the vulnerability requires authenticated admin access.
Deploy a WAF rule that strips or blocks HTML tags submitted in the link_title POST parameter to the plugin endpoint.
Apply a strict Content Security Policy that disallows inline scripts to limit the impact of any stored payload that does execute.
Disable the plugin entirely until a patched release is available if it is not business-critical.

bash

# Configuration example: disable the vulnerable plugin via WP-CLI across a multi-site network
wp plugin deactivate mylinksdump --network
wp plugin delete mylinksdump