CVE-2026-3354: WordPress Wikilookup Plugin XSS Flaw

CVE-2026-3354 Overview

The Wikilookup plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the 'Popup Width' setting across all versions up to and including 1.1.5. This vulnerability stems from insufficient input sanitization and output escaping in the plugin's administrative interface. Authenticated attackers with Administrator-level access can inject arbitrary web scripts into pages that execute whenever a user accesses the compromised page.

Critical Impact

Malicious scripts injected through the administrative settings can persist and execute in the browsers of users accessing affected pages, potentially leading to session hijacking, data theft, or further administrative compromise on WordPress multi-site installations.

Affected Products

• WordPress Wikilookup plugin version 1.1.5 and earlier
• WordPress multi-site installations with the Wikilookup plugin
• WordPress installations where unfiltered_html capability has been disabled

Discovery Timeline

• 2026-03-21 - CVE CVE-2026-3354 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-3354

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability exists within the administrative display view of the Wikilookup plugin, specifically in the admin_wikilookup_display.php file. The 'Popup Width' setting accepts user input without proper sanitization, allowing malicious JavaScript code to be stored in the database and rendered without adequate output escaping.

The vulnerability requires network access and high-privileged credentials (Administrator-level), but once exploited, the injected scripts can affect users across different security boundaries. This is particularly dangerous in WordPress multi-site environments where administrative actions in one site can impact the broader installation. The scope change indicates that successful exploitation can impact resources beyond the vulnerable component.

This vulnerability specifically affects environments where the unfiltered_html capability has been disabled. Normally, WordPress administrators can post unfiltered HTML, but in hardened configurations or multi-site setups, this capability is restricted. The Wikilookup plugin fails to properly handle input in these restricted scenarios, creating an avenue for XSS attacks that would otherwise be mitigated by WordPress's built-in security measures.

Root Cause

The root cause is improper input validation (CWE-79) in the plugin's settings handling. The code at line 26 of admin_wikilookup_display.php fails to sanitize user-supplied input for the 'Popup Width' setting before storing it in the database, and does not properly escape the output when rendering the setting value. This allows JavaScript code to be injected and executed in the administrative context.

Attack Vector

The attack requires an authenticated user with Administrator-level privileges to access the Wikilookup plugin settings page. The attacker enters malicious JavaScript payload in the 'Popup Width' field instead of a legitimate numeric value. When the settings are saved, the malicious script is stored in the WordPress database. Subsequently, when any user (including other administrators) views a page that renders this setting value, the injected script executes in their browser context.

The vulnerability mechanism involves the direct output of the stored setting value without proper escaping. According to the WordPress Plugin Code Review, the affected code path fails to use WordPress's sanitization functions such as esc_attr() or wp_kses() when handling the popup width parameter. For detailed technical analysis, refer to the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-3354

Indicators of Compromise

• Unexpected JavaScript code or HTML tags in Wikilookup plugin settings, particularly the 'Popup Width' field
• Anomalous script execution or network requests originating from WordPress administrative pages
• Database entries containing script tags or event handlers in the wp_options table related to Wikilookup settings

Detection Strategies

• Review WordPress database for malicious content in Wikilookup plugin options using SQL queries to inspect settings values
• Monitor administrative activity logs for unusual modifications to Wikilookup plugin settings
• Deploy Web Application Firewall (WAF) rules to detect XSS payloads in POST requests to plugin settings endpoints
• Use WordPress security plugins to scan for stored malicious content in plugin configuration data

Monitoring Recommendations

• Enable and review WordPress audit logs for all administrative setting changes
• Configure alerts for modifications to plugin settings, especially in multi-site environments
• Implement Content Security Policy (CSP) headers to mitigate impact of XSS exploitation
• Regularly scan WordPress installations for known vulnerable plugin versions using automated security tools

How to Mitigate CVE-2026-3354

Immediate Actions Required

• Audit the 'Popup Width' setting in the Wikilookup plugin for any suspicious or non-numeric values
• Review all Wikilookup plugin settings and sanitize any potentially malicious content
• Consider temporarily disabling the Wikilookup plugin until a patched version is available
• Restrict administrator access to trusted users only and audit recent administrative activity

Patch Information

At the time of publication, users should check for updated versions of the Wikilookup plugin in the WordPress plugin repository. Monitor the WordPress Plugin Development Snapshot for security fixes addressing the input sanitization issue. Ensure that any update properly implements esc_attr(), sanitize_text_field(), or similar WordPress sanitization functions for the 'Popup Width' setting.

Workarounds

• Deactivate and remove the Wikilookup plugin if it is not essential to site functionality
• Implement additional input validation at the server level using WordPress hooks to filter the plugin's settings before storage
• Apply stricter Content Security Policy headers to limit script execution and reduce XSS impact
• In multi-site installations, restrict plugin activation to trusted super administrators only

# Configuration example - Add CSP headers to WordPress via .htaccess
# Add these lines to your .htaccess file to help mitigate XSS attacks
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';"
Header set X-Content-Type-Options "nosniff"
Header set X-XSS-Protection "1; mode=block"