CVE-2026-5340: Fancy Image Show WordPress XSS Vulnerability

CVE-2026-5340 Overview

CVE-2026-5340 is a Stored Cross-Site Scripting (XSS) vulnerability in the Fancy Image Show plugin for WordPress. The flaw affects all versions up to and including 9.1. It exists in the plugin's fancy-img-show shortcode, which fails to sanitize user-supplied attributes and does not escape output before rendering. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript into pages. The malicious script executes in the browser of any visitor who accesses an affected page. The vulnerability is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact

Authenticated contributors can persist JavaScript payloads that execute against site visitors and administrators, enabling session theft, account takeover, and unauthorized administrative actions through forged requests.

Affected Products

• Fancy Image Show plugin for WordPress, all versions up to and including 9.1
• WordPress sites permitting contributor-level (or higher) user registration
• Any page or post embedding the fancy-img-show shortcode

Discovery Timeline

• 2026-05-12 - CVE-2026-5340 published to the National Vulnerability Database (NVD)
• 2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-5340

Vulnerability Analysis

The vulnerability stems from improper handling of shortcode attributes inside the Fancy Image Show plugin. When a contributor adds the fancy-img-show shortcode to a post, the plugin reads attribute values supplied by the user and renders them directly into the page HTML. Neither input sanitization nor output escaping is applied. As a result, attribute values containing HTML or JavaScript are persisted in the database and reflected to every visitor who loads the page.

Because the payload is stored, exploitation does not require any social engineering of the victim beyond ordinary site browsing. The injected script runs in the security context of the WordPress origin, granting access to cookies, the DOM, and authenticated session state for any logged-in visitor — including administrators reviewing contributor submissions.

Root Cause

The shortcode handler in fancy-image-show.php (referenced at lines 117 and 178 in tag 9.1) accepts attribute values through the standard WordPress shortcode_atts() mechanism without applying esc_attr(), esc_html(), wp_kses(), or sanitize_text_field() before output. WordPress shortcodes do not automatically sanitize attributes, so the responsibility falls on the plugin author. The missing escaping at the output sink is the proximate cause.

Attack Vector

An attacker first obtains a contributor account, either through open registration or by compromising an existing low-privilege user. The attacker then creates or edits a post containing the fancy-img-show shortcode with a malicious attribute value such as an onerror handler or quote-breakout payload. Once an editor or administrator previews the submission, or once the post is published, the stored script executes for every visitor.

The vulnerability requires authentication and low privileges. The scope is changed because script execution in the WordPress front-end affects security-relevant data belonging to other users, including administrators.

No verified exploit code available. Refer to the Wordfence and WordPress
plugin trac references for source-level technical details.

Detection Methods for CVE-2026-5340

Indicators of Compromise

• Post or page content containing fancy-img-show shortcode attributes with <script>, javascript:, or HTML event handler tokens such as onerror=, onload=, or onmouseover=
• New or recently modified posts authored by contributor-level accounts that include the fancy-img-show shortcode
• Outbound browser requests from site visitors to attacker-controlled domains shortly after rendering affected pages
• Unexpected administrative actions or session activity originating from administrator IP addresses after viewing contributor drafts

Detection Strategies

• Query the wp_posts table for post_content LIKE '%fancy-img-show%' and review attribute values for HTML or JavaScript tokens
• Inspect the WordPress audit log for contributor accounts creating posts that embed the affected shortcode
• Deploy a web application firewall rule that flags shortcode attributes containing angle brackets, quotes paired with event handlers, or javascript: URIs

Monitoring Recommendations

• Enable Content Security Policy (CSP) reporting to surface inline script execution on pages rendering the plugin
• Monitor for new contributor account registrations followed by rapid post creation, a common precursor to stored XSS abuse
• Alert on administrator session cookies being accessed from unexpected geographic locations after the publication of contributor content

How to Mitigate CVE-2026-5340

Immediate Actions Required

• Update the Fancy Image Show plugin to a version newer than 9.1 once the vendor releases a patched build; if no patch is available, deactivate and remove the plugin
• Audit all existing posts containing the fancy-img-show shortcode and remove or sanitize attribute values that include script content
• Review contributor-level and author-level accounts, removing unused accounts and resetting credentials for any suspicious entries
• Rotate administrator session cookies and authentication keys if stored payloads are discovered

Patch Information

At the time of CVE publication, no fixed version is referenced in the NVD entry. Consult the Wordfence Vulnerability Intel advisory and the WordPress Plugin Source Code repository for the latest fix status and patched release.

Workarounds

• Restrict who can use the fancy-img-show shortcode by limiting contributor-level publication rights or requiring editor approval before publishing
• Apply a WordPress pre_kses or do_shortcode_tag filter to strip HTML and script content from fancy-img-show attributes before rendering
• Deploy a Content Security Policy that disallows inline scripts (script-src 'self') to neutralize injected payloads
• Use a web application firewall to block requests posting shortcode content containing script tokens

# Example: identify affected posts via WP-CLI
wp db query "SELECT ID, post_title, post_author FROM wp_posts \
  WHERE post_content LIKE '%fancy-img-show%' \
  AND (post_content LIKE '%<script%' \
       OR post_content LIKE '%onerror=%' \
       OR post_content LIKE '%javascript:%');"

# Temporarily disable the plugin while remediating
wp plugin deactivate fancy-image-show