CVE-2026-5341: NMR Strava Activities Plugin XSS Flaw

CVE-2026-5341 Overview

CVE-2026-5341 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the NMR Strava activities plugin for WordPress. The flaw resides in the plugin's strava_nmr_connect shortcode and impacts all versions up to and including 1.0.14. Insufficient input sanitization and output escaping on user-supplied shortcode attributes allow authenticated attackers with contributor-level access or higher to inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any visitor who accesses the affected page, enabling session theft, redirection, and further client-side attacks. The vulnerability is categorized under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated contributors can inject persistent JavaScript that executes against every visitor of an affected WordPress page, including administrators.

Affected Products

NMR Strava Activities Plugin for WordPress — versions up to and including 1.0.14
WordPress sites using the strava_nmr_connect shortcode
Fixed in version 1.0.15

Discovery Timeline

2026-05-08 - CVE-2026-5341 published to NVD
2026-05-08 - Last updated in NVD database

Technical Details for CVE-2026-5341

Vulnerability Analysis

The NMR Strava activities plugin exposes a shortcode named strava_nmr_connect that accepts user-supplied attributes. When the shortcode is rendered, the plugin embeds attribute values into the HTML output without applying WordPress escaping functions such as esc_attr() or esc_html(). The vulnerable code paths are located in nmr-strava-activities.php at lines 247 and 259 in version 1.0.14, as documented in the WordPress Plugin Code Reference.

Because the shortcode can be embedded directly into posts and pages by any user with the edit_posts capability, contributor-level accounts can store malicious payloads. The injected content persists in the database and executes whenever any user, including administrators, views the affected page. Successful exploitation can lead to administrator account takeover, plugin installation, or full site compromise through privilege chaining.

Root Cause

The root cause is missing input sanitization on shortcode attributes and missing output escaping when those attributes are rendered into the page DOM. WordPress provides standard sanitization APIs, but the plugin neither validates the attribute structure nor escapes the values prior to concatenation into HTML.

Attack Vector

The attack vector is network-based and requires authentication at contributor level or above. An attacker authors a post containing the strava_nmr_connect shortcode with attributes carrying a JavaScript payload. After submission, when the post is previewed, published, or viewed, the unescaped attribute value executes in the visitor's browser context. The scope is changed because the script executes against any user session viewing the page.

No verified public proof-of-concept code is available. Refer to the Wordfence Vulnerability Analysis for additional technical context.

Detection Methods for CVE-2026-5341

Indicators of Compromise

Posts or pages containing the strava_nmr_connect shortcode with attributes containing <script>, onerror=, onload=, or JavaScript URI schemes.
Unexpected outbound requests from administrator browsers to attacker-controlled domains after viewing plugin-rendered content.
New administrator accounts or modified user roles created shortly after a contributor-level user edited content.

Detection Strategies

Query the WordPress wp_posts table for occurrences of strava_nmr_connect and inspect attribute values for HTML or JavaScript syntax.
Review web server access logs for POST requests to /wp-admin/post.php and /wp-admin/admin-ajax.php from contributor accounts followed by visits that load the affected page.
Apply web application firewall rules that flag shortcode parameters containing event handlers or <script> tags.

Monitoring Recommendations

Monitor WordPress audit logs for content creation by contributor-level accounts and inspect new posts containing shortcode attributes.
Alert on changes to user roles, new privileged account creation, and modifications to plugin or theme files following content edits.
Track browser-side errors and Content Security Policy (CSP) violations originating from rendered plugin pages.

How to Mitigate CVE-2026-5341

Immediate Actions Required

Update the NMR Strava activities plugin to version 1.0.15 or later, which adds proper sanitization and escaping as shown in the patched code.
Audit all existing posts and pages for instances of the strava_nmr_connect shortcode and review attribute values for malicious payloads.
Review the contributor and author user list and remove accounts that are not actively required.

Patch Information

The vendor released version 1.0.15 of the NMR Strava activities plugin, which addresses the issue by sanitizing shortcode attributes and escaping output. The complete fix is documented in the WordPress Plugin Change Set. Site administrators should apply the update through the WordPress plugin dashboard.

Workarounds

Deactivate the NMR Strava activities plugin until the update to 1.0.15 can be applied.
Restrict the use of shortcodes for contributor-level users by adjusting capability filters or using a role management plugin.
Deploy a web application firewall rule to block requests containing the strava_nmr_connect shortcode with suspicious attribute patterns.
Enforce a strict Content Security Policy to limit inline script execution on the WordPress front-end.

bash

# Update the plugin via WP-CLI
wp plugin update nmr-strava-activities --version=1.0.15

# Verify installed version
wp plugin get nmr-strava-activities --field=version

# Search posts for the affected shortcode
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%strava_nmr_connect%';"