CVE-2026-6858 Overview
CVE-2026-6858 affects the Transbank Webpay WordPress plugin in versions prior to 1.14.0. The plugin fails to sanitize and escape log entries before rendering them in the WordPress administration interface. Unauthenticated attackers can inject malicious payloads that are stored in plugin logs and later executed when an administrator views those logs. This is a Stored Cross-Site Scripting (XSS) flaw classified under CWE-79. Successful exploitation executes attacker-controlled JavaScript within an authenticated administrator's browser session.
Critical Impact
Unauthenticated attackers can persistently inject JavaScript into administrator dashboards, enabling session theft, account takeover, and arbitrary actions performed with administrative privileges.
Affected Products
- Transbank Webpay WordPress plugin versions before 1.14.0
- WordPress installations integrating Webpay payment processing
- Administrator users who view plugin log output
Discovery Timeline
- 2026-06-22 - CVE-2026-6858 published to the National Vulnerability Database
- 2026-06-22 - Last updated in NVD database
Technical Details for CVE-2026-6858
Vulnerability Analysis
The Transbank Webpay plugin captures transaction and integration data into log records accessible from the WordPress admin interface. The plugin writes input-derived content directly into log views without applying output encoding or HTML escaping. An attacker who can trigger a logged event, such as a payment request or callback to a public plugin endpoint, can supply crafted parameters containing JavaScript. When an administrator subsequently opens the log view, the browser parses the stored payload as active script. The attack requires user interaction from the administrator (viewing the logs) but no authentication from the attacker. The scope change in the impact reflects that the injected script executes in the privileged admin browser context, beyond the original component boundary.
Root Cause
The root cause is missing output sanitization and escaping of log data prior to rendering in HTML. The plugin treats stored log content as trusted, omitting calls to WordPress escaping primitives such as esc_html() or wp_kses() before display. Any field reachable by the logging routine therefore becomes a stored XSS sink.
Attack Vector
The attack vector is network-based and unauthenticated. An attacker submits crafted input to a publicly reachable plugin endpoint or workflow that triggers log generation. The payload persists in the log store. When an administrator opens the affected log interface, the script runs with the administrator's session, enabling cookie theft, CSRF token extraction, plugin or theme installation, and creation of new privileged accounts. See the WPScan Vulnerability Report for additional technical detail.
Detection Methods for CVE-2026-6858
Indicators of Compromise
- Log entries within the Transbank Webpay plugin containing <script> tags, javascript: URIs, or HTML event handlers such as onerror= and onload=.
- Unexpected administrator account creation or privilege changes following an admin session that opened plugin logs.
- Outbound requests from administrator browsers to unknown domains shortly after viewing the WordPress admin panel.
Detection Strategies
- Search plugin log files and database tables for HTML or JavaScript syntax that should not appear in transaction metadata.
- Inspect WordPress access logs for anonymous POST requests to Webpay endpoints carrying script-like payloads in parameters.
- Review WordPress audit trails for administrative changes correlated with recent log viewing activity.
Monitoring Recommendations
- Enable Content Security Policy (CSP) reporting on the WordPress admin interface to surface inline script execution attempts.
- Alert on creation of new administrator accounts and modifications to user roles.
- Monitor file integrity for wp-content/plugins/ and active theme directories to detect unauthorized changes.
How to Mitigate CVE-2026-6858
Immediate Actions Required
- Upgrade the Transbank Webpay plugin to version 1.14.0 or later on all WordPress sites.
- Audit plugin logs for stored payloads and purge any entries containing HTML or script content.
- Rotate administrator credentials and invalidate active sessions if log viewing occurred while the plugin was vulnerable.
Patch Information
The vendor addressed the issue in Transbank Webpay version 1.14.0 by adding sanitization and escaping for log data prior to display. Refer to the WPScan Vulnerability Report for advisory details and patch references.
Workarounds
- Restrict administrator access to the plugin log interface until the upgrade is applied.
- Place the WordPress admin path behind IP allow-listing or an authenticated reverse proxy.
- Deploy a Web Application Firewall (WAF) rule to block requests to Webpay endpoints containing HTML tags or javascript: schemes.
# Update the Transbank Webpay plugin using WP-CLI
wp plugin update transbank-webpay --version=1.14.0
wp plugin list --name=transbank-webpay --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
