CVE-2026-8844: WordPress Responsive Check XSS Vulnerability

CVE-2026-8844 Overview

CVE-2026-8844 is a Stored Cross-Site Scripting (XSS) vulnerability in the Responsive Check plugin for WordPress, affecting all versions up to and including 0.0.3. The flaw resides in the rspc_check_shortcode() function, where the url and button shortcode attributes are echoed directly into iframe src attributes without esc_attr() or esc_url() sanitization. Authenticated users with contributor-level access or higher can inject arbitrary web scripts that execute when visitors access affected pages. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Contributor-level attackers can inject persistent JavaScript that executes in the browsers of all users visiting affected pages, enabling session theft, account takeover, and arbitrary actions in the context of viewing administrators.

Affected Products

Responsive Check plugin for WordPress — versions 0.0.1 through 0.0.3
WordPress sites allowing contributor-level user registration
WordPress installations using the rspcheck shortcode

Discovery Timeline

2026-05-27 - CVE-2026-8844 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-8844

Vulnerability Analysis

The Responsive Check plugin registers a shortcode named rspcheck that renders an iframe used to preview a target URL at different responsive breakpoints. The shortcode handler rspc_check_shortcode() accepts user-supplied attributes including url and button. These attributes are concatenated directly into the iframe src HTML output without context-appropriate escaping.

Because WordPress shortcodes are processed when post content is rendered, malicious payloads stored inside a post or page persist in the database. Any visitor — including administrators previewing contributor submissions — triggers the script when the page loads. Contributors cannot publish posts directly, but pending submissions are typically reviewed by editors and administrators, expanding the impact to privileged sessions.

Root Cause

The root cause is missing output escaping in the shortcode rendering path. WordPress provides esc_attr() for HTML attribute contexts and esc_url() for URL contexts. Neither is applied to the url or button attributes before they are embedded into the iframe markup. The plugin also lacks input validation on the protocol, allowing payloads such as javascript: URIs or attribute-breaking quote characters to reach the rendered DOM.

Attack Vector

An authenticated attacker with contributor privileges or higher creates a post containing the rspcheck shortcode with a crafted url attribute. The injected payload breaks out of the iframe src attribute by closing the quote and adding additional HTML attributes such as onload event handlers. When an editor, administrator, or site visitor views the page, the browser executes the injected JavaScript in the site origin. The attacker can exfiltrate session cookies, perform forced administrative actions through the WordPress REST API, or pivot to install backdoors.

See the Wordfence Vulnerability Report and the WordPress plugin source code for the unsanitized shortcode handler.

Detection Methods for CVE-2026-8844

Indicators of Compromise

Posts or pages containing rspcheck shortcodes with url attribute values containing quote characters, javascript: schemes, or HTML event handlers such as onload= or onerror=.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after viewing contributor-submitted content.
New administrator accounts, modified user roles, or plugin installations following editorial review of pending submissions.

Detection Strategies

Scan the wp_posts table for the literal string [rspcheck combined with suspicious characters: ", ', <script, javascript:, or on[a-z]+=.
Review WordPress audit logs for contributor accounts creating or modifying posts that include the rspcheck shortcode.
Inspect rendered page HTML for malformed iframe src attributes or unexpected inline event handlers in the iframe context.

Monitoring Recommendations

Monitor administrator and editor sessions for anomalous REST API calls to /wp-json/wp/v2/users or /wp-json/wp/v2/plugins immediately after post-preview activity.
Alert on creation of low-privilege accounts that subsequently publish or edit posts containing shortcodes from vulnerable plugins.
Track plugin inventory and version data to flag installs of responsive-checker-real-time at version 0.0.3 or earlier.

How to Mitigate CVE-2026-8844

Immediate Actions Required

Deactivate and remove the Responsive Check plugin until a patched version is published, since no fixed release is identified in the advisory.
Audit all existing posts and pages for the rspcheck shortcode and remove any instances containing untrusted attribute values.
Restrict contributor-level registrations and review pending submissions in an isolated browser profile without active administrator sessions.

Patch Information

At the time of publication, no patched version of the Responsive Check plugin has been identified in the Wordfence advisory. Site operators should track the plugin's WordPress.org repository for an updated release that applies esc_url() and esc_attr() to all shortcode attributes before rendering.

Workarounds

Remove the plugin entirely if business requirements do not strictly depend on the rspcheck shortcode.
Deploy a Web Application Firewall (WAF) rule that blocks POST requests to /wp-admin/post.php containing the rspcheck shortcode with quote characters or javascript: schemes.
Apply a Content Security Policy (CSP) that disallows inline script execution and restricts iframe sources to a trusted allowlist, reducing the impact of injected payloads.

bash

# Example: locate posts containing the vulnerable shortcode
wp db query "SELECT ID, post_title, post_author FROM wp_posts \
  WHERE post_content LIKE '%[rspcheck%' \
  AND (post_content LIKE '%javascript:%' \
       OR post_content REGEXP 'on[a-z]+=' \
       OR post_content LIKE '%\"%');"

# Disable the plugin until a patch is released
wp plugin deactivate responsive-checker-real-time
wp plugin delete responsive-checker-real-time