CVE-2026-57764 Overview
CVE-2026-57764 is a stored Cross-Site Scripting (XSS) vulnerability in the Surbma | Yoast SEO Breadcrumb Shortcode WordPress plugin versions 1.2 and earlier. The flaw allows authenticated users with Contributor-level privileges to inject malicious JavaScript that executes in the browsers of other users viewing affected pages. The vulnerability is classified under CWE-79, improper neutralization of input during web page generation. Exploitation requires user interaction and results in a scope change, enabling attacks against site visitors and administrators.
Critical Impact
A Contributor-level attacker can inject persistent JavaScript payloads that execute in higher-privileged user sessions, enabling session theft, credential harvesting, or unauthorized administrative actions.
Affected Products
- Surbma | Yoast SEO Breadcrumb Shortcode WordPress plugin versions <= 1.2
- WordPress installations with the vulnerable plugin activated
- Sites permitting Contributor-level account registration
Discovery Timeline
- 2026-07-02 - CVE-2026-57764 published to NVD
- 2026-07-02 - Last updated in NVD database
Technical Details for CVE-2026-57764
Vulnerability Analysis
The Surbma | Yoast SEO Breadcrumb Shortcode plugin fails to properly sanitize user-supplied input before rendering it in the page context. Contributor accounts can insert shortcode attributes or content that includes unescaped HTML and JavaScript. When another user renders the affected content, the injected script executes in that user's authenticated browser session.
The scope-changed nature of the flaw means the injected script runs outside the security boundary of the original attacker. Editors and administrators reviewing Contributor submissions are the primary targets. Successful exploitation can lead to account takeover of privileged users, arbitrary content modification, or plugin installation for persistence.
Root Cause
The root cause is insufficient output encoding and input validation within the plugin's shortcode handler. The plugin trusts input from authenticated users without applying WordPress functions such as esc_html(), esc_attr(), or wp_kses() before echoing content into the DOM. This aligns with the CWE-79 weakness class of improper neutralization.
Attack Vector
The attack requires network access, low privileges (Contributor), and user interaction from a victim who views the malicious content. An attacker with a Contributor account submits a post or page containing the vulnerable shortcode with a crafted payload. When an editor or administrator previews or publishes the submission, the payload executes with that user's privileges. See the Patchstack XSS Vulnerability Advisory for technical details.
Detection Methods for CVE-2026-57764
Indicators of Compromise
- Unexpected <script> tags or event handlers such as onerror= and onload= in post content submitted by Contributor accounts
- Outbound requests from administrator browsers to unfamiliar domains after previewing Contributor submissions
- New administrator accounts or modified user roles created shortly after Contributor content review
- Unusual entries in wp_posts containing encoded JavaScript payloads within shortcode attributes
Detection Strategies
- Audit all posts submitted by Contributor-role users for HTML tags, JavaScript event handlers, and encoded payloads within [surbma_yoast_breadcrumb] shortcodes
- Deploy a Web Application Firewall (WAF) rule set to identify XSS payload patterns in POST requests to wp-admin/post.php
- Enable WordPress activity logging to correlate Contributor content submissions with subsequent administrator actions
Monitoring Recommendations
- Monitor plugin version inventories across WordPress deployments and flag any instance running Surbma | Yoast SEO Breadcrumb Shortcode <= 1.2
- Alert on Content Security Policy (CSP) violations reported by browsers accessing WordPress admin pages
- Track privilege changes and administrator login sessions originating from unusual IP addresses following Contributor content interactions
How to Mitigate CVE-2026-57764
Immediate Actions Required
- Deactivate the Surbma | Yoast SEO Breadcrumb Shortcode plugin until a patched version is confirmed available
- Review and remove any Contributor-submitted content containing suspicious shortcode payloads
- Audit all Contributor and Author accounts for legitimacy and disable unused accounts
- Rotate administrator session cookies and enforce password resets for privileged users who reviewed Contributor content
Patch Information
At the time of publication, refer to the Patchstack XSS Vulnerability Advisory for the latest patch status. Upgrade to a version above 1.2 once released by the vendor.
Workarounds
- Restrict Contributor account creation and require manual approval for new lower-privileged users
- Configure a strict Content Security Policy (CSP) that disallows inline scripts on the WordPress site
- Deploy a WAF with rules targeting XSS patterns in shortcode parameters and post content
- Remove the plugin entirely if breadcrumb functionality is provided by the primary Yoast SEO plugin
# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate surbma-yoast-breadcrumb-shortcode
wp plugin delete surbma-yoast-breadcrumb-shortcode
# Audit posts for suspicious script content
wp post list --post_status=pending --format=csv --fields=ID,post_author,post_title \
| grep -iE 'script|onerror|onload'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
