CVE-2026-6397: WordPress Sticky Plugin XSS Vulnerability

CVE-2026-6397 Overview

CVE-2026-6397 is a stored Cross-Site Scripting (XSS) vulnerability in the Sticky plugin for WordPress, affecting versions up to and including 2.5.6. The flaw resides in the cvmh_sticky_front_render() function, which processes the readmoretext attribute of the cvmh-sticky shortcode without proper input sanitization or output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript that executes in the browsers of users viewing pages containing the malicious shortcode. The vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated contributors can inject persistent JavaScript payloads that execute against site visitors and administrators, enabling session hijacking, credential theft, and unauthorized administrative actions.

Affected Products

Sticky plugin for WordPress, versions 2.5.6 and earlier
WordPress installations running the vulnerable Sticky plugin with Contributor or higher accounts enabled
Any WordPress site exposing the cvmh-sticky shortcode to authenticated content authors

Discovery Timeline

2026-05-20 - CVE-2026-6397 published to NVD
2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-6397

Vulnerability Analysis

The Sticky plugin registers the cvmh-sticky shortcode and renders its output through the cvmh_sticky_front_render() function defined in includes/functions.php. The function accepts a readmoretext attribute supplied by the content author and passes the value through apply_filters() before concatenating it directly into the HTML response. No escaping function such as esc_html(), esc_attr(), or wp_kses() is applied prior to output.

Because WordPress stores shortcode attributes in post content, the injected payload persists in the database. Each subsequent rendering of the page re-executes the attacker-controlled markup in the visitor's browser. The stored nature of this flaw broadens its impact beyond reflected XSS, since a single submission affects every viewer of the compromised page.

Root Cause

The root cause is missing output escaping in cvmh_sticky_front_render(). The function trusts the filtered attribute value and emits it inline within HTML, violating WordPress's documented data validation guidance. Filter callbacks registered against the attribute do not enforce HTML escaping, so any script tags or event handlers supplied by a Contributor reach the rendered DOM unchanged.

Attack Vector

An authenticated attacker with at least Contributor permissions creates or edits a post containing the cvmh-sticky shortcode and supplies a JavaScript payload inside the readmoretext attribute. When an administrator previews the submitted post or any visitor loads the published page, the payload executes in their browser context. The attacker can steal session cookies, perform CSRF-style actions against the WordPress REST API, or pivot toward administrative account takeover. See the Wordfence Vulnerability Report and the WordPress Plugin Code Reference for the vulnerable code path.

Detection Methods for CVE-2026-6397

Indicators of Compromise

Post or page content containing cvmh-sticky shortcodes with readmoretext attributes that include <script>, onerror=, onload=, or javascript: substrings.
Outbound HTTP requests from administrator browsers to unfamiliar domains immediately after viewing posts that embed the cvmh-sticky shortcode.
New or modified WordPress user accounts with elevated roles created shortly after a Contributor submitted content using the Sticky plugin.

Detection Strategies

Audit the wp_posts table for shortcode attributes containing HTML or JavaScript syntax, focusing on readmoretext values.
Inspect web server access logs for requests to posts that contain the cvmh-sticky shortcode and correlate with anomalous administrator session activity.
Deploy a Web Application Firewall (WAF) rule that flags shortcode attribute values containing angle brackets or javascript: URIs.

Monitoring Recommendations

Monitor WordPress role and capability changes, especially privilege escalations from Contributor to Editor or Administrator.
Alert on edits to posts by low-privileged users that introduce shortcode attributes containing scripting syntax.
Track plugin version inventory across managed WordPress sites and alert when Sticky 2.5.6 or earlier remains installed.

How to Mitigate CVE-2026-6397

Immediate Actions Required

Update the Sticky plugin to a version newer than 2.5.6 once the maintainer publishes a fix, or deactivate the plugin if no patched release is available.
Review existing posts and pages for malicious cvmh-sticky shortcode usage and remove injected payloads from the database.
Restrict Contributor and higher accounts to trusted users, and rotate session cookies for any administrator who viewed suspicious content.

Patch Information

At the time of publication, no fixed version has been identified in the NVD record. Site operators should monitor the Wordfence Vulnerability Report and the WordPress plugin repository for a patched release that adds esc_html() or wp_kses_post() escaping to the cvmh_sticky_front_render() function.

Workarounds

Disable the Sticky plugin until a patched version is released.
Remove the cvmh-sticky shortcode from active templates and posts to eliminate the rendering path.
Apply a WAF rule that blocks POST and PUT requests containing readmoretext attribute values with <, >, or javascript: characters.
Reduce the number of users with Contributor or higher roles and require multi-factor authentication on all content author accounts.

bash

# Configuration example: temporarily disable the Sticky plugin via WP-CLI
wp plugin deactivate sticky

# Search the database for potentially malicious shortcode usage
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%cvmh-sticky%' AND (post_content LIKE '%<script%' OR post_content LIKE '%onerror=%' OR post_content LIKE '%javascript:%');"