CVE-2026-8624: LJ Comments Import Reloaded XSS Flaw

CVE-2026-8624 Overview

CVE-2026-8624 is a Reflected Cross-Site Scripting (XSS) vulnerability in the LJ Comments Import: Reloaded plugin for WordPress. The flaw affects all versions up to and including 0.97.1. It stems from improper sanitization of the PHP_SELF server variable, which incorporates attacker-controllable PATH_INFO data appended to the script name. The plugin echoes this value at two distinct unsanitized output points within the same function, enabling unauthenticated attackers to inject arbitrary web scripts. Exploitation requires user interaction such as clicking a crafted link.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session, potentially leading to session theft, account takeover, or redirection to malicious sites when a logged-in administrator follows a crafted link.

Affected Products

WordPress LJ Comments Import: Reloaded plugin versions through 0.97.1
All WordPress installations running the vulnerable plugin
Sites where administrators or privileged users may follow attacker-supplied links

Discovery Timeline

2026-05-20 - CVE-2026-8624 published to NVD
2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-8624

Vulnerability Analysis

The vulnerability is a classic reflected XSS issue categorized under [CWE-79]. The LJ Comments Import: Reloaded plugin reads the PHP_SELF server variable and emits it directly into the HTML response without sanitization or output encoding. Because most web servers populate PHP_SELF with the script name concatenated with any PATH_INFO segment supplied by the client, an attacker can append arbitrary content to the URL path. That content is then reflected verbatim into the rendered page.

The plugin contains two distinct echo statements that emit this tainted value inside the same function, doubling the available injection surface. An attacker crafts a URL of the form https://victim.example/wp-admin/.../lj_comments_import.php/"><script>...</script> and lures a logged-in user to visit it. The injected payload executes in the user's browser context, with access to cookies, session storage, and any DOM the page exposes.

Root Cause

The root cause is insufficient input sanitization and missing output escaping when handling the PHP_SELF server variable. The plugin trusts $_SERVER['PHP_SELF'] as a safe value, ignoring that web servers append client-controlled PATH_INFO to it. Neither htmlspecialchars() nor an equivalent context-aware encoder is applied before reflection.

Attack Vector

Exploitation is remote and requires no authentication, but does require user interaction. An attacker constructs a malicious link that appends a script payload to the plugin's PHP script path. When a victim clicks the link, the server reflects the payload into the response HTML at two locations. The injected script executes under the victim's origin, enabling cookie theft, CSRF-style actions against the WordPress admin interface, and arbitrary DOM manipulation.

The vulnerability mechanism is documented in the plugin source at lines 129 and 161 of lj_comments_import.php. See the WordPress Plugin Source Code and the Wordfence Vulnerability Report for technical details.

Detection Methods for CVE-2026-8624

Indicators of Compromise

HTTP requests targeting lj_comments_import.php with appended PATH_INFO containing script tags, event handlers, or URL-encoded <, >, or quote characters
Web server access logs showing requests with unusual path segments after .php/ on the plugin endpoint
Referrer headers from external domains pointing to plugin admin pages with anomalous URL structures
Outbound browser requests from administrator sessions to attacker-controlled domains shortly after visiting plugin pages

Detection Strategies

Inspect HTTP access logs for requests matching lj_comments_import.php/* with non-standard PATH_INFO content
Deploy Web Application Firewall (WAF) rules that flag reflected XSS patterns in URL paths, particularly against known plugin endpoints
Audit installed WordPress plugins for the presence of LJ Comments Import: Reloaded at version 0.97.1 or earlier
Use Content Security Policy (CSP) violation reports to surface inline script execution attempts

Monitoring Recommendations

Enable verbose logging on WordPress admin endpoints and forward logs to a centralized SIEM for analysis
Monitor for administrator account anomalies such as session changes, new admin users, or unexpected plugin installations
Alert on outbound connections from browsers to unknown domains immediately after admin panel navigation

How to Mitigate CVE-2026-8624

Immediate Actions Required

Deactivate the LJ Comments Import: Reloaded plugin until a patched version is released and verified
Remove the plugin entirely if it is not actively in use on the WordPress installation
Educate administrators and editors to avoid clicking unsolicited links pointing to the WordPress admin interface
Apply WAF signatures that block reflected XSS payloads targeting PHP_SELF-based reflection points

Patch Information

At the time of publication, no vendor-supplied patch has been documented in the NVD entry. The vulnerability affects all versions through 0.97.1. Consult the Wordfence Vulnerability Report for any patch updates and verify the plugin repository for newer releases before reactivation.

Workarounds

Restrict access to the WordPress admin directory via IP allowlisting at the web server or reverse proxy layer
Configure a strict Content Security Policy that disallows inline scripts and limits script sources to trusted origins
Use server-level rewrite rules to reject requests containing suspicious characters in PATH_INFO segments targeting plugin scripts
Replace direct PHP_SELF references in custom code with sanitized equivalents such as htmlspecialchars($_SERVER['PHP_SELF'], ENT_QUOTES, 'UTF-8')

bash

# Example nginx rule to block script-like payloads in PATH_INFO on the plugin endpoint
location ~* /wp-content/plugins/lj-comments-import-reloaded/.*\.php {
    if ($request_uri ~* "(<|%3C|script|onerror|onload)") {
        return 403;
    }
}