CVE-2026-4075: WordPress FAQ Manager Lite XSS Vulnerability

CVE-2026-4075 Overview

The BWL Advanced FAQ Manager Lite plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the baf_sbox shortcode functionality affecting all versions up to and including 1.1.1. This vulnerability arises from insufficient input sanitization and output escaping on user-supplied shortcode attributes, allowing authenticated attackers with Contributor-level access or higher to inject malicious scripts that execute when users view affected pages.

Critical Impact

Authenticated attackers can inject persistent malicious JavaScript through FAQ shortcode attributes, potentially stealing user credentials, session tokens, or performing actions on behalf of site visitors including administrators.

Affected Products

• BWL Advanced FAQ Manager Lite plugin for WordPress versions up to and including 1.1.1
• WordPress installations using the vulnerable baf_sbox shortcode functionality
• Sites allowing Contributor-level or higher user access to create/edit content with shortcodes

Discovery Timeline

• 2026-03-26 - CVE-2026-4075 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-4075

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability exists in the baf_sbox() function within the BWL Advanced FAQ Manager Lite plugin. The core issue is that multiple shortcode attributes are directly interpolated into HTML element attributes without proper sanitization or escaping.

The vulnerable attributes include sbox_id, sbox_class, placeholder, highlight_color, highlight_bg, and cont_ext_class. When these attributes are processed by the baf_sbox() function, they are inserted directly into the rendered HTML output without using WordPress's esc_attr() function or other appropriate escaping mechanisms. This allows an attacker with the ability to create or edit content containing shortcodes to inject arbitrary JavaScript code.

The attack requires authentication at the Contributor level or above, which provides some limitation on exploitation. However, many WordPress sites grant Contributor access to guest authors or team members who may not be fully trusted, making this a significant concern for multi-user WordPress installations.

Root Cause

The root cause of this vulnerability is the absence of output escaping in the baf_sbox() function when rendering shortcode attributes. WordPress provides the esc_attr() function specifically for escaping attribute values before output, but this security measure was not implemented for the affected shortcode attributes. The vulnerable source code shows the direct interpolation of user-controlled values into HTML attributes.

Attack Vector

The attack is network-based and requires an authenticated user with at least Contributor privileges to create or modify content containing the baf_sbox shortcode. The attacker crafts a malicious shortcode with JavaScript payload embedded in one of the vulnerable attributes.

When a victim (including administrators) views the page containing the injected shortcode, the malicious JavaScript executes in their browser context. This can lead to session hijacking, credential theft, defacement, redirection to malicious sites, or further privilege escalation within the WordPress installation.

The vulnerability exploitation flow involves crafting a shortcode with specially constructed attribute values that break out of the HTML attribute context and inject script tags or event handlers. For detailed technical information, refer to the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-4075

Indicators of Compromise

• Unusual or obfuscated content in posts or pages containing the baf_sbox shortcode
• Shortcode attributes containing JavaScript event handlers such as onmouseover, onerror, or onclick
• Presence of <script> tags or encoded JavaScript within FAQ shortcode parameters
• Unexpected external script sources being loaded on pages containing FAQ elements

Detection Strategies

• Audit all content containing the baf_sbox shortcode for suspicious attribute values
• Implement Content Security Policy (CSP) headers to detect and block inline script execution
• Review WordPress audit logs for recent content modifications by Contributor-level users
• Deploy a Web Application Firewall (WAF) with XSS detection rules to identify exploitation attempts

Monitoring Recommendations

• Enable and regularly review WordPress activity logging for shortcode-related content changes
• Monitor client-side JavaScript errors that may indicate blocked XSS attempts
• Implement real-time alerting for CSP violation reports
• Regularly scan WordPress installations for known vulnerable plugin versions

How to Mitigate CVE-2026-4075

Immediate Actions Required

• Update BWL Advanced FAQ Manager Lite plugin to the latest patched version immediately
• Audit existing content for potentially malicious shortcode injections
• Review and restrict Contributor-level access to trusted users only
• Consider temporarily disabling the plugin if an immediate update is not possible

Patch Information

A patch has been released for this vulnerability. The WordPress Changeset details the security fix implementing proper esc_attr() escaping for all vulnerable shortcode attributes. Site administrators should update to the latest version available through the WordPress plugin repository.

Workarounds

• Temporarily remove Contributor-level access from untrusted users until the plugin is updated
• Disable the BWL Advanced FAQ Manager Lite plugin if it is not actively required
• Implement a Web Application Firewall with XSS filtering to provide an additional layer of protection
• Use WordPress security plugins to scan for and block malicious shortcode content

# Configuration example
# WordPress wp-config.php - Restrict plugin editing to administrators only
define('DISALLOW_FILE_EDIT', true);

# Review all posts containing the baf_sbox shortcode via WP-CLI
wp post list --post_status=any --fields=ID,post_title,post_content | grep -i "baf_sbox"

# Check current plugin version
wp plugin list --fields=name,version | grep bwl-advanced-faq