CVE-2026-77820: WPComplete WordPress Plugin XSS Vulnerability

CVE-2026-77820 Overview

CVE-2026-77820 is a Stored Cross-Site Scripting (XSS) vulnerability in the WPComplete plugin for WordPress. The flaw resides in the handling of the empty shortcode attribute and affects all versions up to and including 2.9.9.0. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. Injected scripts execute in the browser of any user who visits the affected page. Exploitation requires the premium (Pro) version of the plugin; the free version is not impacted. The vulnerability is tracked under CWE-79.

Critical Impact
Authenticated contributors can persist JavaScript payloads that execute against site visitors and administrators, enabling session theft, account takeover, and further site compromise.

Affected Products

WPComplete Pro plugin for WordPress, all versions ≤ 2.9.9.0
WordPress sites where contributor-or-higher accounts can be created or are already provisioned
Sites using WPComplete shortcodes that accept the empty attribute

Discovery Timeline

2026-09-19 - CVE-2026-77820 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-77820

Vulnerability Analysis

The WPComplete plugin exposes shortcodes whose empty attribute value is rendered into page output without adequate sanitization or escaping. When a contributor authors a post or page containing the vulnerable shortcode, they can supply attacker-controlled markup through the empty attribute. That value is later reflected into the HTML served to any visitor of the injected page, resulting in stored XSS.

Because the payload persists in post content and executes in an authenticated administrator's browser context, the vulnerability can be chained into administrative actions such as creating new admin accounts, modifying plugin settings, or injecting backdoor code through the theme editor. The scope is marked as changed in the CVSS vector, reflecting that script execution crosses the security authority of the vulnerable component into that of visiting users.

Root Cause

The root cause is missing input sanitization on the incoming shortcode attribute and missing output escaping when the attribute value is emitted into HTML. The vulnerable code paths are referenced in the WordPress plugin repository at includes/class-wpcomplete.php line 305 and public/class-wpcomplete-public.php lines 1692, 1802, and 1859. Neither sanitize_text_field() on input nor esc_attr() / esc_html() on output is applied to the empty attribute.

Attack Vector

An authenticated user with contributor privileges or higher creates or edits a post containing a WPComplete shortcode. The attacker supplies a malicious payload as the empty attribute value. Once the post is published or previewed by a higher-privileged user, the payload executes in that user's session. The attack requires network access to the WordPress site and low-privilege authentication, but no user interaction beyond viewing the affected page. See the Wordfence Vulnerability Report for additional technical context.

No verified public exploit code is available. The vulnerability manifests when a crafted empty attribute value is rendered by the plugin's shortcode handler without escaping; the referenced source files above show the unescaped output sinks.

Detection Methods for CVE-2026-77820

Indicators of Compromise

Post or page content containing WPComplete shortcodes with empty= attribute values that include <script>, onerror=, onload=, javascript:, or HTML entity-encoded variants.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after viewing plugin-rendered pages.
New administrator accounts, modified user roles, or altered plugin/theme files created shortly after a contributor edits content.

Detection Strategies

Query the wp_posts table for post content matching WPComplete shortcode patterns with suspicious attribute values, focusing on the empty attribute.
Review the WordPress audit log for contributor-level users publishing or editing posts that include WPComplete shortcodes.
Inspect referenced source lines in class-wpcomplete-public.php for local plugin modifications and confirm the installed version against 2.9.9.0.

Monitoring Recommendations

Enable a web application firewall rule set that inspects POST bodies to wp-admin/post.php for XSS payloads embedded in shortcode attributes.
Monitor Content Security Policy (CSP) violation reports for inline script executions on pages that render WPComplete shortcodes.
Alert on privilege changes, new admin user creation, and modifications to wp_options performed from browser sessions immediately after viewing contributor-authored content.

How to Mitigate CVE-2026-77820

Immediate Actions Required

Update WPComplete Pro to a version later than 2.9.9.0 as soon as a patched release is available from the vendor.
Audit all existing contributor accounts and remove or downgrade any that are not actively required.
Review recently published or edited posts for WPComplete shortcodes containing suspicious empty attribute values and purge malicious content.

Patch Information

No fixed version is listed in the NVD entry at the time of publication. Site administrators should monitor the Wordfence Vulnerability Report and the vendor's release notes for a patched build addressing the empty attribute handling in class-wpcomplete-public.php.

Workarounds

Deactivate the WPComplete Pro plugin until a patched version is released if course-completion functionality is not business-critical.
Restrict post publishing to editor-or-higher roles and require review of contributor submissions before rendering.
Deploy a strict Content Security Policy that disallows inline scripts on pages rendering WPComplete shortcodes.
Add a WAF rule that blocks shortcode attributes containing <, >, or javascript: tokens in requests to WordPress editing endpoints.

bash

# Example WordPress WP-CLI commands to inventory the plugin and audit content
wp plugin get wpcomplete --field=version
wp db query "SELECT ID, post_author, post_status FROM wp_posts WHERE post_content LIKE '%[wpcomplete%empty=%'"
wp user list --role=contributor --fields=ID,user_login,user_email,user_registered