CVE-2026-76558: WP Import Export Lite XSS Vulnerability

CVE-2026-76558 Overview

CVE-2026-76558 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Import Export Lite WordPress plugin versions prior to 3.9.33. The plugin fails to escape custom field names retrieved from the database before rendering them in the Document Object Model (DOM) of an administrative screen. A user with a role as low as contributor can inject a malicious payload that executes in the browser of any high-privileged user, such as an administrator, who later views the affected screen. The flaw is tracked under [CWE-79] and referenced in the WPScan Vulnerability Report #13543562.

Critical Impact
A contributor-level account can trigger arbitrary JavaScript execution in an administrator's browser session, enabling account takeover and full site compromise.

Affected Products

WP Import Export Lite WordPress plugin versions before 3.9.33
WordPress sites permitting contributor-level user registration
WordPress administrative screens rendering custom field names through the plugin

Discovery Timeline

2026-09-16 - CVE-2026-76558 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-76558

Vulnerability Analysis

The vulnerability is a Stored XSS flaw stemming from missing output encoding in an administrative interface of the WP Import Export Lite plugin. Custom field names stored in the WordPress database are inserted directly into the administrative screen DOM without escaping. Because contributors can create posts and define custom fields, they can persist attacker-controlled markup and script into the database. When an administrator later navigates to the affected screen, the browser parses and executes the injected script under the administrator's session.

Successful exploitation grants the attacker the ability to perform any action available to the victim. This includes creating new administrator accounts, modifying plugin or theme code, or exfiltrating session cookies and nonces. Because the payload executes in a privileged browser context, the impact scales from a low-privilege author account to full WordPress site compromise. The flaw requires user interaction from the administrator, which limits opportunistic exploitation but not targeted attacks.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The plugin retrieves custom field names from the database and concatenates them into HTML output without applying esc_html(), esc_attr(), or an equivalent WordPress escaping function. Trusting stored data because it originated from an authenticated user is an unsafe assumption when that user has a lower privilege level than the eventual viewer.

Attack Vector

An authenticated contributor submits a post or metadata entry containing a custom field whose name includes an XSS payload. The payload is persisted in the WordPress database. When an administrator opens the affected plugin administration screen, the field name is rendered verbatim into the DOM and the script executes with administrator privileges. The attack vector is network-based and requires only contributor privileges plus one administrative page view.

No verified public exploit code is available. Refer to the WPScan Vulnerability Report #13543562 for further technical details.

Detection Methods for CVE-2026-76558

Indicators of Compromise

Custom field names in wp_postmeta containing HTML tags such as <script>, <img, <svg, or event handlers like onerror= and onload=.
Unexpected administrator or editor accounts created shortly after a contributor viewed or edited posts.
Modifications to plugin, theme, or wp_options records not matching known administrator activity.

Detection Strategies

Query the wp_postmeta table for meta_key values containing angle brackets, quotes, or JavaScript URI schemes.
Audit WordPress activity logs for contributor-role users creating or updating custom fields near the time of administrator sessions.
Deploy a Web Application Firewall (WAF) rule to flag POST parameters containing script-like syntax destined for meta-related endpoints.

Monitoring Recommendations

Enable WordPress audit logging plugins to record custom field creation and role changes.
Alert on new administrator account creation events and unauthorized changes to user roles.
Monitor outbound HTTP requests from administrator browser sessions for connections to unknown domains that may indicate cookie exfiltration.

How to Mitigate CVE-2026-76558

Immediate Actions Required

Update the WP Import Export Lite plugin to version 3.9.33 or later on all WordPress installations.
Review contributor and author accounts, disable any that are unused, and reset credentials for accounts created recently.
Inspect the wp_postmeta table for suspicious meta_key values and sanitize or remove malicious entries.

Patch Information

The vendor addressed CVE-2026-76558 in WP Import Export Lite version 3.9.33. Administrators should upgrade through the WordPress plugin dashboard or by manually replacing the plugin files. Confirm the installed version under Plugins after the update completes. See the WPScan Vulnerability Report #13543562 for advisory details.

Workarounds

Restrict registration and remove the contributor role from users who do not require it until the plugin is updated.
Temporarily deactivate the WP Import Export Lite plugin if an immediate update is not feasible.
Apply a WAF rule that blocks HTML and JavaScript characters in custom field name parameters submitted to WordPress.

bash

# Verify installed plugin version and update via WP-CLI
wp plugin get wp-import-export-lite --field=version
wp plugin update wp-import-export-lite --version=3.9.33

# Search postmeta for suspicious custom field names
wp db query "SELECT post_id, meta_key FROM wp_postmeta WHERE meta_key REGEXP '<|>|script|onerror|onload';"