CVE-2026-76128 Overview
The eCommerce Product Catalog plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 3.5.10. The flaw resides in the style attribute of a plugin shortcode and stems from insufficient input sanitization and output escaping [CWE-79]. Authenticated users with contributor-level access or above can inject arbitrary JavaScript that executes when any visitor loads the affected page. The payload evades WordPress's wp_kses_post save-time filter because malicious content is stored inside shortcode brackets without HTML tags, and tainted markup is only produced when the shortcode handler renders the page.
Critical Impact
Authenticated contributors can inject persistent JavaScript that executes in the browser of every visitor, enabling session theft, administrative action forgery, and site defacement.
Affected Products
- eCommerce Product Catalog plugin for WordPress — all versions ≤ 3.5.10
- Vulnerable component: ic/simple-formbuilder/pluggable.php shortcode handler
- Fixed in the release corresponding to WordPress.org changeset #3656358
Discovery Timeline
- 2026-08-25 - CVE-2026-76128 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-76128
Vulnerability Analysis
The plugin exposes a shortcode that accepts a style attribute controlling CSS or inline style output. The handler in pluggable.php (referenced at lines 840 and 842 of tag 3.5.9) reads the attribute value and emits it into rendered HTML without escaping. Because WordPress applies wp_kses_post at content save time, the plugin's shortcode invocation passes through untouched. The attribute value is plain text at storage; the dangerous HTML only materializes when the shortcode is expanded during page rendering. This save-time versus render-time asymmetry is the core defect.
An authenticated contributor can craft a post containing the shortcode with a style value that terminates the intended attribute context and introduces script content or event handlers. When an administrator or visitor loads the post, the browser parses the injected markup and executes attacker-controlled JavaScript in the site's origin.
Root Cause
The shortcode handler concatenates the attacker-controlled style attribute into HTML output without applying esc_attr() or equivalent context-appropriate escaping. Sanitization relies on WordPress's global post filter, which does not inspect shortcode attribute contents.
Attack Vector
Exploitation requires network access to the WordPress site and an authenticated account at contributor privilege or higher. No user interaction beyond visiting the injected page is required. The scope changes because script executes in the context of any authenticated administrator viewing the content. See the Wordfence Vulnerability Report and WordPress Plugin Code Review for the vulnerable code path.
Detection Methods for CVE-2026-76128
Indicators of Compromise
- Posts, pages, or product entries authored by contributor-level accounts containing the plugin's shortcode with unusually long or encoded style attribute values.
- Outbound requests from visitor browsers to unfamiliar domains sourced from pages that render the plugin's shortcode.
- Unexpected administrative actions, such as new admin users or plugin installations, correlated with recent contributor content submissions.
Detection Strategies
- Query the wp_posts table for shortcode invocations belonging to the eCommerce Product Catalog plugin and inspect style attribute contents for <, javascript:, on*=, or HTML-entity-encoded equivalents.
- Deploy a Content Security Policy (CSP) in report-only mode to surface inline-script or event-handler violations on affected pages.
- Review WordPress audit logs for pending-review posts submitted by contributors that were later approved without content diffing.
Monitoring Recommendations
- Alert on modifications to posts containing the vulnerable shortcode until the plugin is patched.
- Monitor administrative sessions for anomalous requests to /wp-admin/ endpoints originating from pages that embed the shortcode.
- Track plugin version telemetry across managed WordPress fleets to identify installations still running 3.5.10 or earlier.
How to Mitigate CVE-2026-76128
Immediate Actions Required
- Update the eCommerce Product Catalog plugin to the version released in WordPress changeset #3656358 or later.
- Audit all contributor and author accounts, disabling any that are inactive or unrecognized.
- Purge or edit existing posts containing suspicious style attribute values within the plugin's shortcodes.
Patch Information
The vendor addressed the flaw in the release tracked by WordPress Changeset #3656358. The fix applies proper escaping to the shortcode's style attribute at render time. Administrators should apply the update through the WordPress plugin management console and verify the installed version reflects the patched release.
Workarounds
- Restrict content creation privileges by removing contributor roles from untrusted users until the patch is applied.
- Deploy a strict Content Security Policy that disallows inline scripts and unsafe inline event handlers site-wide.
- Configure a Web Application Firewall (WAF) rule to block requests containing shortcode payloads with angle brackets or javascript: sequences inside style attributes.
# Example WAF rule (ModSecurity) to block suspicious shortcode style attributes
SecRule ARGS "@rx style=\"[^\"]*(<|javascript:|on\\w+=)" \
"id:1026076128,phase:2,deny,log,status:403,\
msg:'Potential CVE-2026-76128 exploitation attempt against eCommerce Product Catalog shortcode'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
