CVE-2026-57387: picu Stored XSS Vulnerability

CVE-2026-57387 Overview

CVE-2026-57387 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the picu WordPress plugin. The flaw exists in all versions up to and including 3.5.1. Improper neutralization of user-supplied input during web page generation allows attackers to inject persistent JavaScript payloads. Stored payloads execute in the browsers of users who view affected pages, enabling session theft, credential harvesting, and unauthorized actions performed under the victim's authenticated context. Exploitation requires user interaction but no authentication, and the scope changes because injected script runs in the trust context of the WordPress site.

Critical Impact

Unauthenticated attackers can persistently inject scripts that execute against site users and administrators, exposing sessions and enabling further compromise of the WordPress site.

Affected Products

• picu WordPress plugin, all versions through 3.5.1
• WordPress sites running the vulnerable plugin
• Site users and administrators who load pages rendering the tainted input

Discovery Timeline

• 2026-07-13 - CVE-2026-57387 published to the National Vulnerability Database (NVD)
• 2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-57387

Vulnerability Analysis

The picu plugin fails to properly sanitize or encode user-controlled input before including it in generated HTML output. When the tainted input is rendered, the browser interprets attacker-controlled markup as executable script. Because the payload is stored server-side, every subsequent visitor to the affected page triggers execution without further attacker interaction.

The vulnerability falls under CWE-79, Improper Neutralization of Input During Web Page Generation. The CVSS vector indicates the scope changes when the payload executes, meaning injected script can affect resources beyond the vulnerable component, such as the WordPress admin session. The Exploit Prediction Scoring System (EPSS) currently rates exploitation likelihood at 0.18%.

Root Cause

The root cause is missing or insufficient output encoding on fields that accept user-supplied data. The plugin stores the input in the database and later emits it into HTML contexts without applying WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses_post(). Any HTML or JavaScript in the stored value renders as active markup.

Attack Vector

An attacker submits a crafted payload through a plugin-exposed input field that accepts and stores content. When an administrator or another user loads the page that renders this stored value, the script executes in that user's browser session. The attacker can then exfiltrate cookies, perform administrative actions via the REST API, or pivot to further site compromise. Refer to the Patchstack Vulnerability Advisory for advisory-level detail.

Detection Methods for CVE-2026-57387

Indicators of Compromise

• Unexpected <script>, <iframe>, or event-handler attributes (for example onerror=, onload=) stored in picu-managed database rows or post metadata
• Outbound requests from administrator browsers to unfamiliar domains shortly after loading picu-rendered pages
• New administrator accounts, modified user roles, or unauthorized plugin installations following visits to affected pages

Detection Strategies

• Query the WordPress database for picu-related tables and postmeta entries containing HTML tags or JavaScript keywords such as script, onerror, javascript:
• Review web server access logs for POST requests to picu endpoints containing encoded angle brackets (%3C, %3E) or script tokens
• Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution originating from plugin-rendered pages

Monitoring Recommendations

• Alert on WordPress administrative actions (user creation, role change, plugin install) that originate within seconds of loading a picu page
• Monitor for anomalous session token reuse across geographies, a common signature of stolen admin cookies
• Track file integrity of WordPress core and plugin directories for unauthorized modifications following suspected exploitation

How to Mitigate CVE-2026-57387

Immediate Actions Required

• Update the picu plugin to a version later than 3.5.1 once the vendor publishes a fixed release
• Audit stored picu content for injected HTML or JavaScript and remove tainted entries
• Rotate WordPress administrator credentials and invalidate active sessions if exploitation is suspected

Patch Information

At the time of publication, the Patchstack Vulnerability Advisory is the authoritative reference. Apply the fixed plugin version as soon as the maintainer releases it, and subscribe to Patchstack or the WordPress plugin repository for notifications.

Workarounds

• Deactivate the picu plugin until a patched version is available if the affected functionality is not business-critical
• Restrict access to picu input endpoints using a web application firewall rule that blocks HTML tags and JavaScript scheme URIs in form fields
• Enforce a strict Content Security Policy that disallows inline scripts (script-src 'self') to reduce the impact of any residual XSS

# Example WAF/ModSecurity rule to block script payloads in picu form submissions
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1002026573,\
   msg:'Blocked potential XSS payload targeting picu (CVE-2026-57387)'"
  SecRule ARGS "@rx (?i)(<script|onerror\s*=|javascript:)" "t:none,t:urlDecodeUni"