CVE-2026-4278: WordPress Simple Download Counter XSS Flaw

CVE-2026-4278 Overview

The Simple Download Counter plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the sdc_menu shortcode that affects all versions up to and including 2.3. This security flaw stems from insufficient input sanitization and output escaping on user-supplied shortcode attributes, specifically the text and cat attributes. Authenticated attackers with Contributor-level access or higher can exploit this vulnerability to inject arbitrary JavaScript code into WordPress pages, which executes whenever users access the compromised content.

Critical Impact
Authenticated attackers can inject persistent malicious scripts that execute in the browsers of all users visiting affected pages, potentially leading to session hijacking, credential theft, and site defacement.

Affected Products

Simple Download Counter plugin for WordPress version 2.3 and earlier
WordPress sites using vulnerable versions of the Simple Download Counter plugin
Any WordPress installation with Contributor-level users having access to the vulnerable shortcode

Discovery Timeline

2026-03-26 - CVE-2026-4278 published to NVD
2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-4278

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability exists due to improper handling of user-controlled input within the sdc_menu shortcode functionality. The plugin fails to implement proper WordPress escaping functions when rendering shortcode attributes to HTML output. Specifically, the text attribute is rendered directly into HTML content at line 159 of functions-shortcode.php without using esc_html() or equivalent sanitization. Similarly, the cat attribute is inserted into HTML class attributes at lines 135 and 157 without proper escaping via esc_attr().

The vulnerability requires authentication with at least Contributor-level privileges, which limits the attack surface to multi-author WordPress sites or environments where untrusted users have content creation capabilities. Once exploited, the injected scripts persist in the database and execute for every visitor who views the affected page.

Root Cause

The root cause of this vulnerability is the absence of proper output escaping when rendering user-supplied shortcode attributes to the browser. WordPress provides built-in escaping functions such as esc_html() for content and esc_attr() for HTML attributes, but the Simple Download Counter plugin bypasses these security controls. The vulnerable code paths exist in the functions-shortcode.php file where the text attribute is output directly without sanitization, and the cat attribute is used in class attributes without proper escaping.

Attack Vector

This vulnerability is exploitable over the network by authenticated users with Contributor-level access or above. An attacker would create or edit a post containing the sdc_menu shortcode with malicious JavaScript payloads embedded in the text or cat attributes. When the post is published or previewed, the malicious script is stored in the WordPress database. Any user who subsequently views the page containing the compromised shortcode will have the malicious script execute in their browser context, potentially allowing the attacker to steal session cookies, perform actions on behalf of the victim, or redirect users to malicious sites.

The attack flow involves:

Attacker authenticates to WordPress with Contributor or higher privileges
Attacker creates content using the sdc_menu shortcode with XSS payload in vulnerable attributes
Content is published or saved to the database
Victims visit the page and the stored script executes in their browser context

Detection Methods for CVE-2026-4278

Indicators of Compromise

Suspicious JavaScript code or HTML tags within sdc_menu shortcode text or cat attributes in the WordPress database
Unexpected <script> tags or event handlers (e.g., onerror, onload) appearing in posts using the Simple Download Counter shortcodes
Browser-based security alerts or Content Security Policy violations on pages containing the plugin's shortcodes
User reports of unexpected redirects or pop-ups when viewing download counter pages

Detection Strategies

Review WordPress database entries in wp_posts table for sdc_menu shortcodes containing suspicious characters such as <, >, ", ', or JavaScript event handlers
Implement Content Security Policy (CSP) headers to detect and block inline script execution attempts
Monitor web application firewall (WAF) logs for XSS patterns in requests targeting shortcode functionality
Conduct periodic security audits of user-generated content created by Contributor-level accounts

Monitoring Recommendations

Enable WordPress audit logging to track shortcode usage and content modifications by authenticated users
Configure real-time alerting for CSP violation reports that may indicate XSS exploitation attempts
Monitor for unusual JavaScript execution patterns in browser telemetry or client-side security tools
Review access logs for pages containing download counter functionality for anomalous traffic patterns

How to Mitigate CVE-2026-4278

Immediate Actions Required

Update the Simple Download Counter plugin to the latest patched version immediately
Review all existing content using the sdc_menu shortcode for signs of malicious injection
Temporarily restrict Contributor-level access if immediate patching is not possible
Implement a Web Application Firewall (WAF) rule to filter XSS payloads in shortcode parameters

Patch Information

The plugin maintainers have released a security update addressing this vulnerability. The fix involves implementing proper WordPress escaping functions (esc_html() and esc_attr()) for the text and cat shortcode attributes. Site administrators should update to the latest version through the WordPress plugin repository. Technical details of the changeset are available in the WordPress Plugin Changeset. Additional vulnerability details can be found in the Wordfence Threat Intelligence Report.

Workarounds

Disable the Simple Download Counter plugin until the patch can be applied
Remove Contributor-level access from untrusted users to prevent exploitation
Implement Content Security Policy headers to mitigate the impact of any injected scripts
Use a WAF with XSS filtering capabilities to block malicious payloads at the network edge

bash

# Add Content Security Policy header in .htaccess as temporary mitigation
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';"