CVE-2026-57420: Author Box WP Lens Stored XSS Vulnerability

CVE-2026-57420 Overview

CVE-2026-57420 is a stored Cross-Site Scripting (XSS) vulnerability in the Netrr Author Box WP Lens plugin for Divi (author-box-for-divi). The flaw affects all plugin versions up to and including 2.1.5. The issue stems from improper neutralization of user-supplied input during web page generation, classified under CWE-79. An authenticated attacker with low privileges can inject persistent JavaScript that executes in the browser of any user viewing affected pages. The scope change in the CVSS vector indicates injected scripts can affect resources beyond the vulnerable component.

Critical Impact
Authenticated contributors can persist malicious JavaScript in author box output, enabling session hijacking, credential theft, and administrative account takeover through targeted phishing of site administrators.

Affected Products

Netrr Author Box WP Lens (author-box-for-divi) — all versions through 2.1.5
WordPress sites running the Divi theme with the affected plugin installed
Deployments where contributor-level or higher accounts can edit author profile fields

Discovery Timeline

2026-07-13 - CVE-2026-57420 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-57420

Vulnerability Analysis

The Author Box WP Lens plugin renders author metadata in Divi-powered pages without adequately sanitizing or escaping input fields. An authenticated user submits crafted payloads through author box configuration fields, and the plugin stores this input in the WordPress database. When any visitor loads a page displaying the author box, the browser executes the stored script in the site's origin context.

The vulnerability requires low privileges and user interaction, which typically means an administrator or visitor loading a page containing the injected content. Because the CVSS scope is changed, script execution can affect authenticated sessions across the WordPress admin interface, not just the plugin's own output.

Stored XSS in WordPress plugins is a common vector for full site compromise. Attackers commonly chain it with administrative session theft to install backdoored plugins or create rogue administrator accounts.

Root Cause

The plugin fails to apply WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses() when writing author box fields to the DOM. Input passes from persistent storage into rendered HTML without contextual output encoding, violating standard WordPress secure coding guidance.

Attack Vector

An authenticated attacker with permission to edit an author profile submits a payload containing script content in a vulnerable field. The payload persists in the database. When an administrator or site visitor navigates to a page rendering the author box, the malicious script executes in their browser with the site's origin privileges. See the Patchstack XSS Vulnerability Advisory for technical details on the affected fields and payload contexts.

No public proof-of-concept code has been released for this vulnerability.

Detection Methods for CVE-2026-57420

Indicators of Compromise

Unexpected <script> tags, event handlers such as onerror= or onload=, or encoded JavaScript stored in wp_usermeta or plugin-specific tables related to author box configuration.
Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after visiting pages containing author boxes.
New administrator accounts, modified user roles, or plugin installations that were not initiated by legitimate personnel.

Detection Strategies

Query the WordPress database for author box fields containing HTML tags, javascript: URIs, or common XSS vector strings.
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script violations originating from plugin-rendered pages.
Review web server access logs for POST requests to wp-admin/profile.php or plugin settings endpoints containing script-like payloads.

Monitoring Recommendations

Alert on modifications to user metadata associated with contributor, author, or editor roles.
Monitor for unauthorized changes to WordPress options tables and the wp_users table, particularly new accounts with administrator capability.
Track plugin file integrity to detect post-exploitation persistence such as backdoored PHP files.

How to Mitigate CVE-2026-57420

Immediate Actions Required

Update the Author Box WP Lens plugin to a version later than 2.1.5 once released by the vendor.
Audit all existing author profile fields and author box configurations for previously injected payloads and sanitize the stored data.
Restrict contributor, author, and editor account creation to trusted users and enforce multi-factor authentication for all privileged WordPress accounts.

Patch Information

At the time of publication, the vulnerability affects author-box-for-divi versions through 2.1.5. Consult the Patchstack XSS Vulnerability Advisory for the current fixed version and vendor patch status.

Workarounds

Deactivate the Author Box WP Lens plugin until a patched release is available and verified.
Deploy a web application firewall (WAF) rule to block requests containing script tags or JavaScript URI schemes targeting the plugin's editing endpoints.
Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Reduce user roles so that non-essential accounts cannot edit author metadata rendered by the plugin.

bash

# Example WordPress CLI commands to disable the plugin and audit user metadata
wp plugin deactivate author-box-for-divi
wp db query "SELECT user_id, meta_key, meta_value FROM wp_usermeta WHERE meta_value LIKE '%<script%' OR meta_value LIKE '%javascript:%';"