CVE-2026-4278: WordPress Simple Download Counter XSS Flaw

CVE-2026-4278 Overview

The Simple Download Counter plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the sdc_menu shortcode that affects all versions up to and including 2.3. This security flaw stems from insufficient input sanitization and output escaping on user-supplied shortcode attributes, specifically the text and cat attributes. Authenticated attackers with Contributor-level access or higher can exploit this vulnerability to inject arbitrary JavaScript code into WordPress pages, which executes whenever users access the compromised content.

Critical Impact

Authenticated attackers can inject persistent malicious scripts that execute in the browsers of all users visiting affected pages, potentially leading to session hijacking, credential theft, and site defacement.

Affected Products

• Simple Download Counter plugin for WordPress version 2.3 and earlier
• WordPress sites using vulnerable versions of the Simple Download Counter plugin
• Any WordPress installation with Contributor-level users having access to the vulnerable shortcode

Discovery Timeline

• 2026-03-26 - CVE-2026-4278 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-4278

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability exists due to improper handling of user-controlled input within the sdc_menu shortcode functionality. The plugin fails to implement proper WordPress escaping functions when rendering shortcode attributes to HTML output. Specifically, the text attribute is rendered directly into HTML content at line 159 of functions-shortcode.php without using esc_html() or equivalent sanitization. Similarly, the cat attribute is inserted into HTML class attributes at lines 135 and 157 without proper escaping via esc_attr().

The vulnerability requires authentication with at least Contributor-level privileges, which limits the attack surface to multi-author WordPress sites or environments where untrusted users have content creation capabilities. Once exploited, the injected scripts persist in the database and execute for every visitor who views the affected page.

Root Cause

The root cause of this vulnerability is the absence of proper output escaping when rendering user-supplied shortcode attributes to the browser. WordPress provides built-in escaping functions such as esc_html() for content and esc_attr() for HTML attributes, but the Simple Download Counter plugin bypasses these security controls. The vulnerable code paths exist in the functions-shortcode.php file where the text attribute is output directly without sanitization, and the cat attribute is used in class attributes without proper escaping.

Attack Vector

This vulnerability is exploitable over the network by authenticated users with Contributor-level access or above. An attacker would create or edit a post containing the sdc_menu shortcode with malicious JavaScript payloads embedded in the text or cat attributes. When the post is published or previewed, the malicious script is stored in the WordPress database. Any user who subsequently views the page containing the compromised shortcode will have the malicious script execute in their browser context, potentially allowing the attacker to steal session cookies, perform actions on behalf of the victim, or redirect users to malicious sites.

The attack flow involves:

1. Attacker authenticates to WordPress with Contributor or higher privileges
2. Attacker creates content using the sdc_menu shortcode with XSS payload in vulnerable attributes
3. Content is published or saved to the database
4. Victims visit the page and the stored script executes in their browser context

Detection Methods for CVE-2026-4278

Indicators of Compromise

• Suspicious JavaScript code or HTML tags within sdc_menu shortcode text or cat attributes in the WordPress database
• Unexpected <script> tags or event handlers (e.g., onerror, onload) appearing in posts using the Simple Download Counter shortcodes
• Browser-based security alerts or Content Security Policy violations on pages containing the plugin's shortcodes
• User reports of unexpected redirects or pop-ups when viewing download counter pages

Detection Strategies

• Review WordPress database entries in wp_posts table for sdc_menu shortcodes containing suspicious characters such as <, >, ", ', or JavaScript event handlers
• Implement Content Security Policy (CSP) headers to detect and block inline script execution attempts
• Monitor web application firewall (WAF) logs for XSS patterns in requests targeting shortcode functionality
• Conduct periodic security audits of user-generated content created by Contributor-level accounts

Monitoring Recommendations

• Enable WordPress audit logging to track shortcode usage and content modifications by authenticated users
• Configure real-time alerting for CSP violation reports that may indicate XSS exploitation attempts
• Monitor for unusual JavaScript execution patterns in browser telemetry or client-side security tools
• Review access logs for pages containing download counter functionality for anomalous traffic patterns

How to Mitigate CVE-2026-4278

Immediate Actions Required

• Update the Simple Download Counter plugin to the latest patched version immediately
• Review all existing content using the sdc_menu shortcode for signs of malicious injection
• Temporarily restrict Contributor-level access if immediate patching is not possible
• Implement a Web Application Firewall (WAF) rule to filter XSS payloads in shortcode parameters

Patch Information

The plugin maintainers have released a security update addressing this vulnerability. The fix involves implementing proper WordPress escaping functions (esc_html() and esc_attr()) for the text and cat shortcode attributes. Site administrators should update to the latest version through the WordPress plugin repository. Technical details of the changeset are available in the WordPress Plugin Changeset. Additional vulnerability details can be found in the Wordfence Threat Intelligence Report.

Workarounds

• Disable the Simple Download Counter plugin until the patch can be applied
• Remove Contributor-level access from untrusted users to prevent exploitation
• Implement Content Security Policy headers to mitigate the impact of any injected scripts
• Use a WAF with XSS filtering capabilities to block malicious payloads at the network edge

# Add Content Security Policy header in .htaccess as temporary mitigation
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';"