CVE-2026-7441 Overview
CVE-2026-7441 is a Stored Cross-Site Scripting (XSS) vulnerability in the Simple Yearly Archive plugin for WordPress. The flaw affects all versions up to and including 2.2.4. It resides in the posttype attribute of the SimpleYearlyArchive shortcode, where the plugin fails to sanitize input or escape output on user-supplied attributes.
Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript that executes in the browser of any visitor who loads the affected page. The vulnerability is tracked under CWE-79 and reported through the Wordfence Vulnerability Report.
Critical Impact
Authenticated Contributor-level attackers can inject persistent JavaScript that executes against site visitors and administrators, enabling session theft, redirection, and administrative account takeover.
Affected Products
- Simple Yearly Archive plugin for WordPress, versions up to and including 2.2.4
- WordPress sites permitting Contributor-level accounts or higher
- Any WordPress installation rendering the SimpleYearlyArchive shortcode
Discovery Timeline
- 2026-08-05 - CVE-2026-7441 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-7441
Vulnerability Analysis
The Simple Yearly Archive plugin exposes the SimpleYearlyArchive shortcode, which accepts a posttype attribute to filter archived content. The plugin passes this attribute value into rendered HTML output without applying WordPress escaping functions such as esc_attr() or esc_html(). The affected code paths are documented in the plugin source at simple-yearly-archive.php line 135 and line 502.
An authenticated Contributor can embed the shortcode inside a post or page with a malicious posttype value containing HTML or JavaScript. When any user, including administrators, later views the rendered content, the injected script executes in that user's browser session under the site's origin.
Root Cause
The root cause is missing input sanitization and output escaping on the posttype shortcode attribute. WordPress shortcode attributes must be treated as untrusted input, but the plugin renders the value directly into the DOM. This is a classic Stored XSS pattern classified as CWE-79.
Attack Vector
Exploitation requires a network-reachable WordPress site and an authenticated account with at least Contributor privileges. The attacker creates or edits a post containing the SimpleYearlyArchive shortcode with a crafted posttype value designed to break out of the intended attribute context. Once the post is viewed, the payload executes and can steal cookies, hijack sessions, or perform actions as the viewing user. Because Contributor is a low-privilege role commonly granted to guest authors, the attack surface on multi-author sites is broad.
The fix is committed in the WordPress Changeset Update, which introduces proper attribute escaping.
Detection Methods for CVE-2026-7441
Indicators of Compromise
- Posts or pages containing [SimpleYearlyArchive] shortcodes with unusual posttype values containing angle brackets, quotes, javascript:, or event handler strings such as onerror= and onload=.
- Unexpected outbound requests from browsers loading archive pages to attacker-controlled domains.
- New or modified Contributor and Author accounts followed by edits to posts referencing the SimpleYearlyArchive shortcode.
- Administrator sessions initiating account or plugin changes shortly after viewing pages that render the shortcode.
Detection Strategies
- Query the wp_posts table for post_content containing SimpleYearlyArchive combined with <script, on event handlers, or javascript: URIs.
- Deploy Content Security Policy (CSP) reporting to capture inline script execution and out-of-policy script sources on public pages.
- Review web application firewall logs for POST requests to post.php or post-new.php containing shortcode payloads with suspicious characters.
Monitoring Recommendations
- Monitor WordPress audit logs for Contributor and Author role activity involving shortcode insertion.
- Alert on installations of the Simple Yearly Archive plugin at versions 2.2.4 or earlier across managed WordPress fleets.
- Track browser console errors and CSP violations tied to rendered archive pages to surface injected payloads.
How to Mitigate CVE-2026-7441
Immediate Actions Required
- Update the Simple Yearly Archive plugin to the version containing the fix documented in the WordPress Changeset Update.
- Audit all existing posts and pages for the SimpleYearlyArchive shortcode and inspect the posttype attribute for injected markup.
- Review Contributor and Author accounts, remove unused accounts, and rotate credentials for users who authored content while the plugin was vulnerable.
Patch Information
The vendor addressed the vulnerability in a release following 2.2.4. Details are available on the WordPress Plugin Page and in the Wordfence Vulnerability Report. Site owners should upgrade through the WordPress plugin manager and confirm the installed version no longer matches the affected range.
Workarounds
- Deactivate the Simple Yearly Archive plugin until the patched version is installed.
- Restrict Contributor and Author role assignment to trusted users and require editorial review before publishing shortcode-bearing content.
- Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources on the front end.
- Deploy a web application firewall rule to block shortcode attribute values containing <, >, or javascript: sequences on post submission endpoints.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
