CVE-2026-6690: LifePress WordPress Plugin XSS Vulnerability

CVE-2026-6690 Overview

CVE-2026-6690 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the LifePress plugin for WordPress in all versions up to and including 2.2.2. The flaw exists in the lp_update_mds AJAX action, which is registered through wp_ajax_nopriv_lp_update_mds without nonce verification or capability checks. Unauthenticated attackers can supply malicious payloads through the n parameter, which the plugin stores and later renders without sufficient sanitization or output escaping on the admin settings page. The vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Unauthenticated attackers can inject persistent JavaScript that executes in the browser of any administrator viewing the affected settings page, enabling session hijacking, privilege actions, and further site compromise.

Affected Products

LifePress plugin for WordPress, all versions up to and including 2.2.2
WordPress installations exposing the wp_ajax_nopriv_lp_update_mds endpoint
Administrator settings pages that render the stored series name

Discovery Timeline

2026-05-12 - CVE-2026-6690 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-6690

Vulnerability Analysis

The LifePress plugin registers the lp_update_mds AJAX handler through both wp_ajax_lp_update_mds and wp_ajax_nopriv_lp_update_mds. The nopriv variant exposes the handler to unauthenticated visitors. The handler accepts a series name through the n parameter and writes it into plugin storage without performing a nonce check, capability check, or strict input sanitization.

When an administrator later opens the plugin's settings page, the stored value is rendered into the page output without proper escaping. Any script payload supplied through n therefore executes within the administrator's authenticated session context. This combination of missing access control and missing output escaping converts a basic data write into a Stored XSS primitive.

The attack scope is Changed because script executed in the administrator context can act against other WordPress components, create users, modify content, or pivot to plugin and theme files.

Root Cause

The root cause is twofold. First, the AJAX action is registered with the nopriv hook and no authentication, authorization, or nonce verification gates the write path. Second, the stored series name is concatenated into the admin HTML output without applying escaping functions such as esc_html() or esc_attr(). References to the affected source lines are available in the WordPress Plugin Trac and the class-metrics.php source.

Attack Vector

An attacker sends a crafted HTTP POST request to /wp-admin/admin-ajax.php with action=lp_update_mds and a payload in the n parameter containing JavaScript. No authentication is required. The payload persists in plugin data and triggers on the next administrator visit to the LifePress settings page. Additional technical details are documented in the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2026-6690

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing action=lp_update_mds from unauthenticated sources
Stored series name values in LifePress plugin options containing <script>, onerror=, onload=, or javascript: substrings
Unexpected new administrator accounts or modified user roles following administrator visits to the LifePress settings page
Outbound requests from administrator browsers to unfamiliar domains shortly after loading plugin admin pages

Detection Strategies

Inspect web server access logs for admin-ajax.php requests with the lp_update_mds action originating from non-administrative IP addresses
Query the WordPress wp_options table for LifePress entries containing HTML or JavaScript syntax in series name fields
Deploy a web application firewall rule that flags POST bodies to lp_update_mds containing script tags or event handler attributes

Monitoring Recommendations

Enable WordPress audit logging for plugin option changes and administrator session activity
Alert on administrator account creation, role escalation, or plugin and theme file edits that follow access to the LifePress settings page
Forward WordPress and reverse proxy logs to a centralized analytics platform for correlation across requests, sessions, and outbound network activity

How to Mitigate CVE-2026-6690

Immediate Actions Required

Update the LifePress plugin to a version released after 2.2.2 that addresses the missing authorization and output escaping
If no patched release is available, deactivate and remove the LifePress plugin until a fix is published
Audit the WordPress options table and remove any malicious stored values in LifePress series name fields
Force password resets and session invalidation for administrator accounts that may have viewed the affected settings page

Patch Information

No patched version is referenced in the published advisory at the time of NVD publication on 2026-05-12. Monitor the Wordfence advisory and the WordPress Plugin Trac for an update beyond version 2.2.2.

Workarounds

Block external POST requests to admin-ajax.php with action=lp_update_mds at the web application firewall or reverse proxy layer
Restrict /wp-admin/admin-ajax.php access to authenticated sessions where business logic allows
Apply a content security policy that disallows inline scripts on WordPress admin pages to reduce XSS impact

bash

# Configuration example: ModSecurity rule to block unauthenticated lp_update_mds requests
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1026690,\
    msg:'Block CVE-2026-6690 LifePress lp_update_mds abuse'"
    SecRule ARGS:action "@streq lp_update_mds" \
        "chain"
        SecRule ARGS:n "@rx (?i)(<script|onerror=|onload=|javascript:)" \
            "t:none,t:urlDecodeUni"