CVE-2026-28116: Progress Planner Stored XSS Vulnerability

CVE-2026-28116 Overview

CVE-2026-28116 is a stored cross-site scripting (XSS) vulnerability in the Emilia Projects Progress Planner plugin for WordPress. The plugin fails to properly neutralize user-supplied input during web page generation, allowing attackers to inject persistent JavaScript payloads. The flaw affects all versions of Progress Planner up to and including 1.9.0. Exploitation requires high-privilege authentication and user interaction, and the impact crosses the WordPress security boundary into the victim's browser context. The issue is tracked under CWE-79 and was published to NVD on June 2, 2026.

Critical Impact

Authenticated attackers can store malicious scripts that execute in the browser of any administrator or user viewing the affected plugin pages, enabling session theft, account takeover, and further compromise of the WordPress site.

Affected Products

• Emilia Projects Progress Planner WordPress plugin (all versions through 1.9.0)
• WordPress sites with Progress Planner installed and active
• Administrative interfaces rendering plugin-managed content

Discovery Timeline

• 2026-06-02 - CVE-2026-28116 published to NVD
• 2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-28116

Vulnerability Analysis

The vulnerability stems from improper neutralization of input during web page generation in the Progress Planner plugin. The plugin accepts user-controlled values and renders them back into HTML output without adequate sanitization or output encoding. Stored XSS occurs when the malicious payload persists in the plugin's data store and executes whenever a victim loads the affected page. Because exploitation requires high-privilege authentication, the attacker must already hold an account with elevated permissions on the target WordPress site. The scope change in the vulnerability profile indicates that the executed script operates in a security context different from the vulnerable component, typically the browser of an administrator viewing the page.

Root Cause

The root cause is the absence of proper output encoding and input validation in code paths that render plugin data into the WordPress admin or front-end interface. WordPress provides escaping functions such as esc_html(), esc_attr(), and wp_kses(), but the affected code paths in Progress Planner versions through 1.9.0 do not consistently apply them before echoing user-supplied content.

Attack Vector

An authenticated attacker with high privileges submits a crafted payload containing JavaScript through an input field handled by the plugin. The payload is stored in the WordPress database. When a victim, typically another administrator, navigates to a page that renders the stored data, the browser parses the injected script and executes it under the origin of the WordPress site. The attacker can then hijack sessions, perform actions on behalf of the victim, or pivot to deeper compromise.

The vulnerability manifests in plugin code paths that echo stored user input. Refer to the Patchstack Vulnerability Report for additional technical details.

Detection Methods for CVE-2026-28116

Indicators of Compromise

• Unexpected <script> tags, javascript: URIs, or event handler attributes such as onerror= and onload= in Progress Planner database records
• Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after loading plugin pages
• New or modified WordPress administrator accounts created without authorized change records
• Anomalous wp_options or plugin-specific table entries containing HTML markup

Detection Strategies

• Audit Progress Planner database tables and options for HTML or JavaScript content that should not be present in stored fields
• Inspect WordPress access logs for POST requests to plugin endpoints containing encoded script payloads
• Deploy a Web Application Firewall (WAF) ruleset that flags XSS patterns submitted to /wp-admin/ endpoints associated with the plugin

Monitoring Recommendations

• Monitor administrator session activity for actions that originate from automated script execution rather than interactive use
• Alert on creation of new privileged users, plugin installations, or theme edits following access to Progress Planner admin pages
• Track Content Security Policy (CSP) violation reports for inline script execution on WordPress administrative paths

How to Mitigate CVE-2026-28116

Immediate Actions Required

• Update the Progress Planner plugin to a version newer than 1.9.0 as soon as a patched release is published by Emilia Projects
• Review all WordPress administrator and editor accounts and revoke unnecessary high-privilege access
• Audit existing Progress Planner content for previously stored XSS payloads and remove malicious entries
• Rotate WordPress administrator passwords and invalidate active sessions if compromise is suspected

Patch Information

At the time of publication, the Patchstack Vulnerability Report lists Progress Planner versions through 1.9.0 as affected. Administrators should monitor the plugin's official channels for a patched release and apply it immediately upon availability.

Workarounds

• Deactivate the Progress Planner plugin until a fixed version is released if the functionality is non-essential
• Restrict access to the WordPress admin interface using IP allowlisting at the web server or WAF level
• Enforce a strict Content Security Policy that disallows inline script execution in administrative contexts
• Apply the principle of least privilege by limiting the number of accounts that hold administrator or editor roles