CVE-2026-5505: WP-Clippy WordPress Plugin XSS Vulnerability

CVE-2026-5505 Overview

CVE-2026-5505 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP-Clippy plugin for WordPress, affecting all versions up to and including 1.0.0. The flaw resides in the plugin's clippy shortcode, which fails to properly sanitize user-supplied attributes and escape output. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any user who views the affected page, including site administrators. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated contributors can execute arbitrary JavaScript in the browsers of site visitors and administrators, enabling session theft, account takeover, and content manipulation.

Affected Products

WP-Clippy plugin for WordPress, versions up to and including 1.0.0
WordPress sites that allow contributor-level or higher user registration
WordPress sites with the WP-Clippy clippy shortcode enabled

Discovery Timeline

2026-05-05 - CVE-2026-5505 published to the National Vulnerability Database
2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-5505

Vulnerability Analysis

The WP-Clippy plugin registers a clippy shortcode that accepts attributes from post and page content. When the shortcode renders, the plugin inserts user-supplied attribute values directly into HTML output without applying WordPress sanitization functions such as esc_attr() or esc_html(). This allows JavaScript payloads embedded in shortcode attributes to execute when the page is rendered in a browser.

Because WordPress permits contributor-role users to author posts containing shortcodes, any account at this trust level or above can store malicious payloads. The injected script runs in the security context of the WordPress site origin, granting access to cookies, the DOM, and authenticated administrator sessions when a privileged user views the post.

The scope change in the CVSS vector reflects that exploitation impacts users beyond the attacker's privilege boundary. A contributor can affect the sessions and data of editors, administrators, and unauthenticated visitors who load the page.

Root Cause

The root cause is missing input sanitization on shortcode attributes combined with missing output escaping when those attributes are rendered into HTML. WordPress provides esc_attr(), esc_html(), and wp_kses() for this purpose, but the affected code paths in wp-clippy.php (lines 23 and 26 per the WordPress Plugin Code Review) emit attribute values into the response without applying these protections.

Attack Vector

An attacker authenticates to the target WordPress site with a contributor account or higher. The attacker creates or edits a post containing the clippy shortcode with a crafted attribute that includes a JavaScript payload. Once the post is published, or once an administrator previews the draft, the malicious script executes in the viewer's browser. Reference details are available in the Wordfence Vulnerability Analysis.

The vulnerability manifests when the clippy shortcode handler concatenates attribute values into HTML output. See the linked plugin source review for the exact unsanitized variable handling on lines 23 and 26 of wp-clippy.php.

Detection Methods for CVE-2026-5505

Indicators of Compromise

Posts or pages containing [clippy] shortcodes with attribute values that include <script>, javascript:, onerror=, onload=, or other event handler strings
Unexpected outbound requests from administrator browsers to attacker-controlled domains following page views
New WordPress administrator accounts created shortly after a contributor authored a post using the clippy shortcode
Modifications to WordPress options such as siteurl or home that correlate with contributor activity

Detection Strategies

Query the wp_posts table for post_content matching the regex pattern \[clippy[^\]]*< or containing javascript: within shortcode attributes
Inspect plugin file integrity for WP-Clippy and confirm the installed version against 1.0.0 or earlier
Review web server access logs for requests to admin URLs immediately preceded by visits to posts containing the clippy shortcode

Monitoring Recommendations

Monitor WordPress audit logs for post creation and edits by contributor-role accounts, particularly when shortcodes are added
Alert on creation of new administrator users, role escalations, and changes to user capabilities
Track Content Security Policy (CSP) violation reports for inline script execution attempts on public-facing pages

How to Mitigate CVE-2026-5505

Immediate Actions Required

Deactivate and remove the WP-Clippy plugin until a patched version is published, since version 1.0.0 is the latest available release at the time of disclosure
Audit all existing posts and pages for the clippy shortcode and remove any instances containing suspicious attribute values
Review the contributor and author user list and revoke accounts that are not actively required
Force a password reset for all accounts with contributor-level access or higher

Patch Information

No patched version of WP-Clippy has been published as of the NVD publication date of 2026-05-05. Site operators should remove the plugin until the maintainer releases a fixed version that applies esc_attr() and esc_html() to shortcode attributes. Track the Wordfence Vulnerability Analysis entry for patch availability.

Workarounds

Restrict contributor and author registration on the WordPress site to trusted users only
Deploy a Web Application Firewall (WAF) rule that blocks requests containing <script> or event-handler patterns within clippy shortcode attributes
Implement a strict Content Security Policy that disallows inline scripts and limits script sources to trusted origins
Disable the clippy shortcode by adding remove_shortcode('clippy'); to a custom mu-plugin until the vendor releases a fix

bash

# Configuration example: disable the vulnerable shortcode via mu-plugin
mkdir -p wp-content/mu-plugins
cat > wp-content/mu-plugins/disable-clippy.php <<'EOF'
<?php
add_action('init', function () {
    remove_shortcode('clippy');
}, 100);
EOF