CVE-2026-7662: ePaperFlip Publisher Plugin XSS Flaw

CVE-2026-7662 Overview

CVE-2026-7662 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the ePaperFlip Publisher plugin for WordPress in all versions up to and including 1. The flaw resides in the publicationid attribute of the epaperflip_embed shortcode, where user-supplied input is injected directly into inline JavaScript without adequate sanitization or output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts that execute when any user visits an affected page. The vulnerability is classified under CWE-79 and carries a medium-severity rating.

Critical Impact
Authenticated contributors can persist malicious JavaScript in WordPress pages, enabling session theft, credential harvesting, and administrative account compromise when privileged users view affected content.

Affected Products

ePaperFlip Publisher plugin for WordPress (all versions through 1)
WordPress sites using the epaperflip_embed shortcode
WordPress installations allowing Contributor-level or higher user registration

Discovery Timeline

2026-06-09 - CVE-2026-7662 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-7662

Vulnerability Analysis

The ePaperFlip Publisher plugin registers a shortcode named epaperflip_embed that accepts a publicationid attribute. When the shortcode is rendered, the plugin places the attribute value directly inside an inline JavaScript context within the generated HTML output. The plugin does not apply input sanitization on the attribute, nor does it escape the value for the JavaScript context before emitting it to the page.

An authenticated user with Contributor permissions can insert the shortcode into a draft post and supply a crafted publicationid value containing JavaScript-breaking characters. Once the post is published or previewed by an administrator or editor, the injected script executes in the visitor's browser under the site's origin. Persistent script execution enables session hijacking, forced administrative actions through CSRF-style requests, redirection to attacker-controlled domains, and theft of authentication cookies for privileged accounts.

Root Cause

The root cause is insufficient input sanitization and missing context-aware output escaping on the publicationid shortcode attribute. The plugin concatenates the raw attribute value into an inline <script> block without applying esc_js(), esc_attr(), or strict allowlist validation. WordPress provides escaping primitives for exactly this scenario, but the plugin bypasses them. Review the plugin source code for the affected code path.

Attack Vector

Exploitation requires network access to the WordPress site and an authenticated account at the Contributor role or above. The attacker creates or edits a post containing the epaperflip_embed shortcode with a malicious publicationid value designed to break out of the inline JavaScript string and inject arbitrary script. The scope change (S:C) reflects that injected scripts execute against the browser session of any visitor, including higher-privileged WordPress administrators, expanding impact beyond the attacker's initial role. No victim interaction beyond visiting the affected page is required.

Detection Methods for CVE-2026-7662

Indicators of Compromise

Posts or pages containing epaperflip_embed shortcode instances with unusual characters in the publicationid attribute, including quotes, angle brackets, or </script> sequences.
Outbound browser requests from administrator sessions to unfamiliar domains immediately after viewing plugin-rendered pages.
Unexpected creation of new WordPress administrator accounts or modifications to user roles following content edits by Contributor accounts.
Database entries in wp_posts where post_content contains the shortcode alongside JavaScript event handlers or encoded payloads.

Detection Strategies

Audit the wp_posts table for shortcode usage with regex patterns matching epaperflip_embed.*publicationid= and flag attribute values containing non-alphanumeric characters.
Deploy a Web Application Firewall (WAF) rule that inspects POST requests to wp-admin/post.php for shortcode payloads with script-injection signatures.
Monitor WordPress audit logs for content created or modified by Contributor-role accounts that include the affected shortcode.

Monitoring Recommendations

Enable Content Security Policy (CSP) headers in report-only mode to surface inline script violations originating from plugin output.
Log and alert on Contributor and Author account activity that publishes or submits content containing shortcodes.
Review the Wordfence vulnerability report for updated detection signatures and threat intelligence.

How to Mitigate CVE-2026-7662

Immediate Actions Required

Deactivate the ePaperFlip Publisher plugin until a patched version is available, as all current versions through 1 are affected.
Audit existing posts and pages for use of the epaperflip_embed shortcode and remove or sanitize any instances with suspicious publicationid values.
Restrict user registration and review all accounts holding Contributor-level access or above, removing any that are not actively required.
Force password resets for administrator accounts that may have viewed pages containing the vulnerable shortcode.

Patch Information

No patched version is identified in the published advisory at the time of disclosure. Monitor the ePaperFlip Publisher plugin page on WordPress.org for an updated release that addresses the input sanitization and output escaping gap on the publicationid shortcode attribute.

Workarounds

Remove the plugin entirely from WordPress installations where the e-paper embed functionality is not business-critical.
Apply a WAF rule to block requests containing epaperflip_embed shortcodes with characters outside an alphanumeric allowlist in the publicationid parameter.
Restrict the WordPress unfiltered_html capability and avoid granting Contributor or higher roles to untrusted users.
Deploy a strict Content Security Policy disallowing inline scripts to reduce the impact of any successful injection.

bash

# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate epaperflip-publisher
wp plugin delete epaperflip-publisher

# Search the database for existing shortcode instances
wp db query "SELECT ID, post_title, post_status FROM wp_posts \
  WHERE post_content LIKE '%epaperflip_embed%';"