CVE-2026-88997 Overview
CVE-2026-88997 is a stored cross-site scripting (XSS) vulnerability in the JSM Show Post Metadata WordPress plugin before version 4.9.1. The plugin fails to escape post meta keys before rendering them inside an inline event-handler attribute in an admin-facing meta box. A contributor-level user can inject arbitrary JavaScript that executes when a higher-privileged user, such as an editor or administrator, reviews the affected post. The flaw is classified under [CWE-79]: Improper Neutralization of Input During Web Page Generation.
Critical Impact
Contributor accounts can escalate privileges by hijacking administrator sessions through injected JavaScript rendered in the WordPress admin dashboard.
Affected Products
- JSM Show Post Metadata WordPress plugin versions prior to 4.9.1
- WordPress installations that allow contributor-level or higher user registration
- Multi-author WordPress sites where editors or administrators review submitted posts
Discovery Timeline
- 2026-09-23 - CVE-2026-88997 published to the National Vulnerability Database
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-88997
Vulnerability Analysis
The JSM Show Post Metadata plugin displays post meta information in an administrative meta box on the post edit screen. The plugin retrieves post meta keys associated with a post and renders them into HTML that includes inline event-handler attributes such as onclick or onmouseover. Because the plugin does not escape the meta key value before placing it inside the attribute context, an attacker who controls the meta key string can break out of the attribute and inject arbitrary JavaScript.
Exploitation requires an authenticated user with at least contributor privileges. When a reviewer with editor or administrator rights opens the affected post, the injected script runs in their authenticated session, enabling account takeover, plugin installation, or persistent backdoor creation.
Root Cause
The root cause is missing output encoding in an attribute context. WordPress provides esc_js() for JavaScript event handlers and esc_attr() for HTML attribute values. The plugin uses neither when writing post meta keys into inline event-handler attributes, producing a stored XSS sink that persists across page loads.
Attack Vector
The attack requires network access to the WordPress admin interface, high privileges (contributor account), and user interaction from the victim reviewer. A contributor creates or edits a post and sets a crafted post meta key containing attribute-breaking characters and JavaScript payload. When an administrator opens the post edit screen, the plugin renders the meta box and executes the payload in the administrator's browser. Technical details are documented in the WPScan Vulnerability Report.
Detection Methods for CVE-2026-88997
Indicators of Compromise
- Post meta keys containing quotation marks, angle brackets, or JavaScript keywords such as alert, fetch, or document.cookie
- Unexpected administrator account creation or role changes following contributor activity
- New plugin installations or theme file modifications initiated shortly after an administrator viewed a contributor's post
- Outbound HTTP requests from the admin browser to attacker-controlled domains during post review sessions
Detection Strategies
- Audit the wp_postmeta database table for meta_key entries containing characters outside the expected alphanumeric and underscore set
- Review WordPress access logs for POST requests to post.php and post-new.php from contributor accounts followed by admin sessions viewing the same post IDs
- Deploy web application firewall rules that flag meta key values containing attribute-breaking characters
Monitoring Recommendations
- Monitor WordPress user role changes and new administrator account creation events
- Alert on plugin or theme file writes performed during admin sessions that immediately follow contributor post edits
- Log and review browser-originated administrative API calls such as /wp-json/wp/v2/users with elevated role assignments
How to Mitigate CVE-2026-88997
Immediate Actions Required
- Update the JSM Show Post Metadata plugin to version 4.9.1 or later on all WordPress installations
- Audit existing contributor and author accounts and remove any that are inactive or unrecognized
- Review recent post meta entries for suspicious meta keys and remove any that contain script content
Patch Information
The vendor addressed the issue in JSM Show Post Metadata version 4.9.1 by properly escaping post meta keys before output. Administrators should install the update through the WordPress plugin dashboard or by replacing the plugin files directly. Consult the WPScan Vulnerability Report for the fixed version reference.
Workarounds
- Deactivate the JSM Show Post Metadata plugin until the update is applied
- Restrict contributor-level registration and require administrator approval for new author accounts
- Deploy a web application firewall rule that blocks post meta submissions containing HTML special characters in key names
- Enforce the principle of least privilege and avoid reviewing untrusted content while authenticated as an administrator
# Configuration example: update the plugin via WP-CLI
wp plugin update jsm-show-post-meta --version=4.9.1
wp plugin list --name=jsm-show-post-meta --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
