CVE-2026-7850 Overview
CVE-2026-7850 is a stored Cross-Site Scripting (XSS) vulnerability in the WP Magnific Popup WordPress plugin through version 1.0. The plugin fails to properly escape user-controlled link URLs before injecting them into the Document Object Model (DOM) when rendering image load error messages. Authenticated attackers holding Author-level access or higher can inject malicious JavaScript that executes in the browsers of visiting users. The flaw enables session theft, content defacement, and redirection to attacker-controlled infrastructure.
Critical Impact
Authenticated authors can store malicious JavaScript that executes against any visiting user, including administrators, enabling account takeover through session hijacking.
Affected Products
- WP Magnific Popup WordPress plugin through version 1.0
- WordPress installations with the plugin enabled
- Sites permitting Author-level or higher untrusted users
Discovery Timeline
- 2026-06-17 - CVE-2026-7850 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-7850
Vulnerability Analysis
The WP Magnific Popup plugin renders user-supplied link URLs inside image error messages without applying output escaping. When the plugin builds the error message DOM, attacker-controlled URL content is concatenated directly into HTML attributes or text nodes. A browser parsing the resulting markup executes any embedded script payload.
Exploitation requires Author privileges or higher, but no additional administrative role is needed. The attack is stored, meaning the payload persists in WordPress content and triggers automatically when any visitor loads the affected page. User interaction is limited to viewing the page that triggers the broken-image condition.
The scope changes when the script executes, because code injected from one user's content runs in the security context of the WordPress site itself. This allows the attacker to reach administrator sessions and perform privileged actions on their behalf.
Root Cause
The root cause is missing output sanitization of user-controlled link URLs before DOM insertion. The plugin trusts the stored URL value and omits calls to WordPress escaping helpers such as esc_url(), esc_attr(), or esc_html(). This classifies the issue as improper neutralization of input during web page generation [CWE-79].
Attack Vector
An attacker authenticates as an Author and creates or edits content that includes a Magnific Popup gallery referencing a malicious URL. The URL contains JavaScript syntax that activates when the plugin generates an image load error message. When a visitor or administrator opens the page, the browser parses the unsanitized markup and executes the injected payload in the site's origin.
No verified public proof-of-concept code is available. See the WPScan Vulnerability Report for additional technical detail.
Detection Methods for CVE-2026-7850
Indicators of Compromise
- Unexpected <script> tags, javascript: URIs, or event handler attributes within posts, pages, or gallery metadata authored by non-administrator accounts
- Outbound browser requests from administrator sessions to unknown domains immediately after viewing plugin-rendered galleries
- WordPress audit log entries showing Author-role users editing media link URLs with unusual character sequences
Detection Strategies
- Scan the wp_posts table and post meta for stored URL values containing javascript:, data:, onerror=, or HTML tag delimiters
- Inspect rendered pages with a headless browser to capture script execution originating from image error handlers
- Review plugin version metadata across WordPress sites to identify installations running WP Magnific Popup 1.0 or earlier
Monitoring Recommendations
- Enable WordPress activity logging for Author-role content changes and media URL updates
- Forward web server and WordPress logs to a centralized analytics platform for correlation against XSS payload patterns
- Alert on administrator account anomalies such as new admin user creation, plugin installation, or theme edits following plugin page views
How to Mitigate CVE-2026-7850
Immediate Actions Required
- Disable or remove the WP Magnific Popup plugin until a patched release is published by the maintainer
- Audit all Author-level and higher accounts and revoke privileges for accounts that are not strictly required
- Review existing posts and gallery configurations for malicious URLs and remove any injected payloads
Patch Information
No vendor-supplied patch is referenced in the available advisory data. Monitor the WPScan Vulnerability Report and the plugin's WordPress.org listing for an updated release that escapes link URLs prior to DOM insertion.
Workarounds
- Apply a Web Application Firewall (WAF) rule that blocks javascript: URIs and HTML control characters in plugin-handled URL fields
- Restrict the Author role using a capability manager so that untrusted users cannot publish content that invokes the plugin
- Add a Content Security Policy (CSP) header that disallows inline scripts to reduce stored XSS execution impact
# Example Content-Security-Policy header to mitigate inline script execution
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
