CVE-2026-81754: Vigilant Security Suite XSS Vulnerability

CVE-2026-81754 Overview

The Vigilant security suite plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting all versions up to and including 2.10.2. The plugin fails to sanitize the User-Agent HTTP header captured during failed login attempts and does not escape the value when rendering it in the administrative interface. Unauthenticated attackers can inject arbitrary JavaScript by sending a failed login request with a crafted User-Agent header. The payload executes when an administrator later views the logged login attempts.

Critical Impact
Unauthenticated attackers can achieve persistent script execution in the WordPress administrator context, enabling session theft, account takeover, and further compromise of the affected site.

Affected Products

Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… plugin for WordPress
All plugin versions up to and including 2.10.2
WordPress installations that expose the plugin's failed-login logging interface

Discovery Timeline

2026-09-11 - CVE-2026-81754 published to the National Vulnerability Database
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-81754

Vulnerability Analysis

The Vigilant plugin logs failed login attempts to persist context useful for administrators reviewing brute-force activity. Captured context includes the requesting client's User-Agent string. The plugin stores this attacker-controlled value without input sanitization and renders it in the admin dashboard without output escaping. This dual failure creates a stored XSS primitive that any unauthenticated visitor can trigger.

The attack requires no authentication and no social engineering targeting administrators beyond normal review of the plugin's login-attempt logs. Once the crafted User-Agent value is stored, the payload fires whenever the administrator opens the corresponding admin page. Because execution occurs in the administrator's browser session, an attacker can perform any action available to that administrator, including creating new privileged accounts or modifying plugin and theme code.

Root Cause

The root cause is missing input validation on the User-Agent header during failed-login logging and missing HTML output escaping in the plugin's admin.js rendering routines. Relevant plugin source paths include includes/class-login-security.php, includes/class-database.php, and assets/js/admin.js as referenced in the plugin source browser.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker sends an HTTP request to the WordPress login endpoint using invalid credentials and a User-Agent header containing a JavaScript payload. The plugin persists the header value to its database. When an administrator subsequently views the failed-login log, the stored script executes in the admin's browser context. See the Wordfence vulnerability analysis for additional context.

No verified public exploit code is available. Refer to the Vigilante changeset 3669625 for the vendor's remediation diff.

Detection Methods for CVE-2026-81754

Indicators of Compromise

Failed login attempts in web server or WordPress logs where the User-Agent header contains HTML tags such as <script>, <img, <svg, or event handlers like onerror= and onload=.
New WordPress administrator accounts, modified plugin or theme files, or unexpected outbound requests originating from admin sessions shortly after log review.
Requests to wp-login.php from unusual source IPs with abnormally long or non-standard User-Agent values.

Detection Strategies

Inspect the plugin's login-attempt database table for stored values containing HTML or JavaScript syntax.
Add web application firewall rules that flag User-Agent headers containing angle brackets, quotes, or JavaScript keywords on requests to authentication endpoints.
Correlate failed authentication events with subsequent administrator activity to identify potential session hijacking.

Monitoring Recommendations

Alert on creation of new WordPress users with administrator role, particularly outside of change windows.
Monitor WordPress core, plugin, and theme file integrity for unauthorized modifications.
Track browser-side security events such as Content Security Policy (CSP) violations reported from /wp-admin/ paths.

How to Mitigate CVE-2026-81754

Immediate Actions Required

Update the Vigilant plugin to a version later than 2.10.2 as soon as a fixed release is available from the vendor.
Audit the plugin's login-attempt records and purge entries containing HTML or JavaScript payloads before administrators view them.
Review WordPress user accounts and administrator activity logs for signs of exploitation.

Patch Information

The vendor's remediation is tracked in the Vigilante plugin changeset 3669625. Administrators should apply the latest plugin version through the WordPress plugin update mechanism. If no fixed version is available, deactivate and remove the plugin until a patch ships.

Workarounds

Deploy a web application firewall rule that strips or blocks non-printable and HTML metacharacters in the User-Agent header on requests to wp-login.php.
Temporarily deactivate the Vigilant plugin, which removes the vulnerable failed-login logging code path from the site.
Restrict access to the WordPress administrative interface using IP allow-lists or authentication proxies to limit exposure while remediation is pending.

bash

# Example ModSecurity rule to block script-like User-Agent values on the login endpoint
SecRule REQUEST_URI "@endsWith /wp-login.php" \
  "phase:1,chain,deny,status:403,id:1026817540,\
   msg:'Suspicious User-Agent on WordPress login (CVE-2026-81754)'"
    SecRule REQUEST_HEADERS:User-Agent "@rx (?i)(<script|onerror=|onload=|javascript:)"