CVE-2026-8038: Faces of Users WordPress Plugin XSS Flaw

CVE-2026-8038 Overview

CVE-2026-8038 is a Stored Cross-Site Scripting (XSS) vulnerability in the Faces of Users plugin for WordPress. The flaw affects all versions up to and including 0.0.3. It stems from insufficient input sanitization and output escaping on the default shortcode attribute within the facesofusers shortcode. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript that executes in any visitor's browser when an injected page is rendered. The vulnerability is tracked under CWE-79 and was published to the National Vulnerability Database on 2026-05-20.

Critical Impact

Authenticated contributors can persist malicious scripts that execute against site visitors and administrators, enabling session theft, account takeover, and content defacement.

Affected Products

• WordPress Faces of Users plugin versions 0.0.1 through 0.0.3
• WordPress sites permitting Contributor-level registration or above
• Any front-end page that renders the facesofusers shortcode

Discovery Timeline

• 2026-05-20 - CVE-2026-8038 published to NVD
• 2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-8038

Vulnerability Analysis

The Faces of Users plugin registers a facesofusers shortcode that accepts a default attribute. The plugin code at faces-of.php line 62 passes this attribute value into rendered HTML without applying sanitization functions such as sanitize_text_field() or output escaping functions such as esc_attr() or esc_html(). An attacker authenticated as a Contributor or higher can embed the shortcode in post content with a default value containing HTML or JavaScript payloads. WordPress stores the post in the database, and the malicious payload executes whenever a user, including administrators reviewing the submission, loads the page.

The scope-changed CVSS vector indicates the injected script can affect resources beyond the vulnerable component, which is consistent with browser-side script execution against authenticated administrators viewing contributor-submitted drafts.

Root Cause

The root cause is missing input validation and missing output escaping in the shortcode handler. WordPress provides escaping primitives that the plugin does not invoke before emitting attribute values into the rendered DOM. See the WordPress Plugin Code Reference for the affected line.

Attack Vector

Exploitation requires network access and a Contributor account. The attacker authors a post containing the facesofusers shortcode with a crafted default attribute carrying a JavaScript payload. When an administrator previews the draft or a visitor opens the published page, the script executes in their session context. Successful exploitation can hijack sessions via cookie theft, trigger forced administrative actions through XMLHttpRequest, or redirect users to attacker-controlled infrastructure. Refer to the Wordfence Vulnerability Intelligence entry for additional context.

Detection Methods for CVE-2026-8038

Indicators of Compromise

• Posts or pages containing the facesofusers shortcode where the default attribute holds <script>, onerror=, onload=, or javascript: content
• Unexpected outbound requests from administrator browsers to unknown domains after viewing contributor content
• New administrator accounts or modified user roles created shortly after a contributor account submitted a post

Detection Strategies

• Query the wp_posts table for post_content matching facesofusers shortcodes containing HTML tags or event handlers within the default attribute
• Inspect web server access logs for requests to pages rendering the shortcode followed by anomalous administrator activity
• Audit Contributor and Author accounts for posts referencing the vulnerable plugin and review them before publication

Monitoring Recommendations

• Enable a Content Security Policy that restricts inline script execution to flag and block XSS payloads
• Forward WordPress audit logs to a centralized SIEM and alert on role escalations or option changes following contributor post submissions
• Monitor plugin file integrity for the faces-of-users directory and alert on shortcode handler modifications

How to Mitigate CVE-2026-8038

Immediate Actions Required

• Deactivate and remove the Faces of Users plugin until a patched release is published
• Audit all existing posts for the facesofusers shortcode and remove instances containing suspicious default attribute values
• Reset passwords for administrator accounts that may have viewed contributor content while the plugin was active
• Restrict Contributor-level registration on sites that do not require open authoring

Patch Information

No patched version is referenced in the NVD entry at the time of publication. All versions up to and including 0.0.3 remain vulnerable. Site operators should monitor the WordPress plugin repository for an updated release that adds esc_attr() and sanitize_text_field() calls to the shortcode handler.

Workarounds

• Remove the plugin entirely if no patched version is available
• Limit shortcode usage by stripping facesofusers from contributor-submitted content using a pre_post_update filter
• Deploy a web application firewall rule that blocks shortcode attributes containing <, >, or javascript: tokens

# Remove the vulnerable plugin via WP-CLI
wp plugin deactivate faces-of-users
wp plugin delete faces-of-users

# Search posts for the vulnerable shortcode
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%[facesofusers%default=%<%'"