CVE-2026-84930 Overview
CVE-2026-84930 is a stored Cross-Site Scripting (XSS) vulnerability in the CatFolders Document Gallery & PDF Library WordPress plugin before version 2.0.7. The plugin fails to validate a block attribute before using it as an HTML tag name in gallery output. Authenticated users with the Author role or above can inject arbitrary JavaScript that executes in the browser of any visitor viewing the affected post. The flaw is classified under [CWE-79] and requires user interaction to trigger the payload.
Critical Impact
Authenticated attackers with Author-level access can execute arbitrary scripts in the browsers of site visitors, enabling session theft, account takeover, and drive-by redirection to malicious content.
Affected Products
- CatFolders Document Gallery & PDF Library WordPress plugin versions prior to 2.0.7
- WordPress sites permitting Author-or-above accounts to publish gallery blocks
- Sites where administrators or subscribers view posts created by lower-privileged contributors
Discovery Timeline
- 2026-09-05 - CVE-2026-84930 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-84930
Vulnerability Analysis
The vulnerability resides in the plugin's gallery block rendering logic. The plugin accepts a block attribute submitted by the post author and uses it directly as an HTML tag name in the rendered gallery output. Because the attribute value is neither validated against an allowlist of safe tag names nor properly escaped, an attacker can supply a crafted value that closes the intended tag context and injects attacker-controlled markup, including <script> elements or event-handler attributes.
The stored payload persists in the WordPress database as part of the post content. Every subsequent request to the affected post renders the malicious markup in the visitor's browser, executing under the site's origin. Because the payload runs in-session, it can read authentication cookies not protected by the HttpOnly flag, issue authenticated administrative requests, or pivot to further site compromise if an administrator views the post.
Root Cause
The root cause is improper neutralization of input used to construct an HTML tag name. The plugin treats the block attribute as trusted data despite its origin in user-controlled block editor input. No sanitization function such as sanitize_key() or a strict tag-name allowlist is applied before the value is interpolated into the output template.
Attack Vector
An attacker first obtains an account with Author-level privileges or higher, either through legitimate registration on sites that permit it, credential compromise, or social engineering. The attacker then creates or edits a post containing a CatFolders gallery block, tampering with the vulnerable block attribute to inject script content. When any visitor loads the post, the injected script executes in their browser session.
Exploitation requires user interaction, since a target must load the malicious post. Technical details are documented in the WPScan Vulnerability Report.
Detection Methods for CVE-2026-84930
Indicators of Compromise
- Post content containing CatFolders gallery blocks with unexpected characters in tag-name attributes such as <, >, quote marks, or script
- Outbound requests from visitor browsers to unfamiliar domains sourced from post pages hosting gallery blocks
- New administrator accounts, altered user roles, or unexpected plugin installations following Author-level publishing activity
- WordPress wp_posts rows containing block markup with attribute values that do not match a standard HTML tag identifier
Detection Strategies
- Audit wp_posts.post_content for CatFolders block markup and inspect the block attributes used for tag-name rendering
- Review web server access logs for authenticated POST requests to /wp-json/wp/v2/posts or /wp-admin/post.php from Author-level accounts that include gallery block payloads
- Deploy a Web Application Firewall rule that inspects block editor submissions for angle brackets or script keywords in attributes expected to contain only alphanumeric tag names
Monitoring Recommendations
- Alert on privilege changes and administrative actions initiated shortly after an Author account publishes or updates a post
- Monitor Content Security Policy (CSP) violation reports for inline script execution on public post pages
- Track plugin version inventory across WordPress installations to confirm all instances run 2.0.7 or later
How to Mitigate CVE-2026-84930
Immediate Actions Required
- Update the CatFolders Document Gallery & PDF Library plugin to version 2.0.7 or later on all WordPress instances
- Audit existing posts that use CatFolders gallery blocks and remove or sanitize any suspicious markup
- Review the list of accounts holding Author-or-above roles and remove or downgrade any that are no longer required
Patch Information
The vendor addressed the issue in CatFolders Document Gallery & PDF Library version 2.0.7. Administrators should apply the update through the WordPress plugin dashboard or by replacing the plugin files manually. Verify the installed version after upgrade by inspecting the plugin metadata in wp-admin/plugins.php.
Workarounds
- Restrict post publishing to trusted Editor and Administrator accounts until the patch is applied
- Deploy a strict Content Security Policy that disallows inline scripts on public post pages
- Temporarily disable the CatFolders plugin if immediate patching is not possible and gallery functionality is not business-critical
# Update the plugin via WP-CLI
wp plugin update catfolders --version=2.0.7
wp plugin list --name=catfolders --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.