CVE-2026-42750: WPComplete Stored XSS Vulnerability

CVE-2026-42750 Overview

CVE-2026-42750 is a stored Cross-Site Scripting (XSS) vulnerability in the Nexcess WPComplete WordPress plugin. The flaw stems from improper neutralization of input during web page generation [CWE-79]. Versions of WPComplete up to and including 2.9.5.4 are affected.

Authenticated attackers with low privileges can inject malicious scripts that persist in the application and execute in the browsers of other users who view the affected pages. Because the vulnerability has a changed scope, injected payloads can affect resources beyond the originally vulnerable component.

Critical Impact
Authenticated attackers can store malicious JavaScript that executes against site visitors and administrators, enabling session theft, account takeover, and unauthorized administrative actions.

Affected Products

Nexcess WPComplete plugin for WordPress
All versions from n/a through 2.9.5.4
WordPress installations with the WPComplete plugin enabled

Discovery Timeline

2026-05-27 - CVE-2026-42750 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-42750

Vulnerability Analysis

The vulnerability is a stored XSS issue in the WPComplete plugin maintained by Nexcess. Stored XSS occurs when user-supplied input is saved server-side and later rendered in HTML responses without proper encoding or sanitization.

Exploitation requires an authenticated user with low privileges and victim interaction such as visiting a page that renders the injected payload. The scope is changed, meaning the injected script can affect components outside the vulnerable plugin, including the broader WordPress administrative interface.

Successful exploitation can lead to session hijacking, credential theft via fake login overlays, forced administrative actions through the victim's browser, and persistent backdoor injection into rendered pages. The attack is delivered over the network, requires low complexity, and has low confidentiality, integrity, and availability impacts on the immediate component.

Root Cause

The root cause is the failure to apply context-appropriate output encoding or input sanitization when user-supplied data is stored and subsequently rendered into HTML output. WordPress provides functions such as wp_kses_post(), esc_html(), esc_attr(), and sanitize_text_field() for this purpose, but the affected plugin paths do not consistently apply them.

Attack Vector

An authenticated attacker submits a payload containing HTML or JavaScript through a WPComplete input field that lacks sanitization. The plugin stores the payload in the WordPress database. When a victim, including administrators, loads a page that renders the stored content, the browser executes the attacker's script in the context of the WordPress site.

The vulnerability mechanism is described in the Patchstack XSS Vulnerability Report. No verified public exploit code is available at the time of publication.

Detection Methods for CVE-2026-42750

Indicators of Compromise

Unexpected <script> tags, onerror, onload, or javascript: URIs stored in WPComplete-managed post meta or options tables
New or modified WordPress administrator accounts created shortly after low-privileged user activity
Outbound HTTP requests from administrator browsers to unfamiliar domains immediately after loading WPComplete-rendered pages
Anomalous POST requests to WPComplete endpoints containing encoded HTML or JavaScript payloads

Detection Strategies

Review the wp_postmeta and wp_options tables for entries written by WPComplete that contain script tags or HTML event handlers
Inspect web server access logs for authenticated requests to plugin endpoints with payloads containing <, >, or URL-encoded %3Cscript
Correlate browser-side errors or Content Security Policy (CSP) violations on administrative pages with recent low-privileged user activity

Monitoring Recommendations

Enable WordPress audit logging to track content modifications by non-administrative users
Deploy a Web Application Firewall (WAF) ruleset that flags XSS patterns in requests targeting WPComplete URLs
Forward WordPress and web server logs to a centralized analytics platform for correlation and retention

How to Mitigate CVE-2026-42750

Immediate Actions Required

Update WPComplete to a version later than 2.9.5.4 once the vendor releases a fix
Audit all existing WPComplete-managed content for previously injected payloads and remove malicious entries
Restrict the WordPress roles that can interact with WPComplete input fields until a patched version is installed
Rotate session cookies and require password resets for administrators who may have viewed injected content

Patch Information

The vulnerability affects WPComplete versions through 2.9.5.4. Consult the Patchstack XSS Vulnerability Report for the current fixed version and vendor guidance.

Workarounds

Disable or remove the WPComplete plugin until a patched release is verified
Apply a WAF rule that blocks HTML and JavaScript metacharacters in requests to WPComplete endpoints
Enforce a strict Content Security Policy that disallows inline scripts on WordPress administrative pages
Limit plugin configuration access to trusted administrative accounts only

bash

# Example: temporarily deactivate the WPComplete plugin using WP-CLI
wp plugin deactivate wpcomplete

# Verify deactivation
wp plugin status wpcomplete