CVE-2026-92967: WordPress Pochipp Plugin XSS Vulnerability

CVE-2026-92967 Overview

CVE-2026-92967 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Pochipp plugin for WordPress affecting versions up to and including 1.20.2. The flaw exists in the plugin's Thickbox media-upload search interface, where the keyword GET parameter is reflected into an HTML attribute without proper escaping. Unauthenticated attackers can craft a malicious link that, when clicked by an authenticated user with the upload_files capability (Author role or above), executes arbitrary JavaScript in the victim's browser session. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in the context of an authenticated WordPress user with content-upload privileges, enabling session theft, administrative action forgery, or malicious payload injection.

Affected Products

Pochipp plugin for WordPress, versions up to and including 1.20.2
WordPress installations with users holding the upload_files capability (Author role or above)
Sites exposing the /wp-admin/media-upload.php Thickbox interface with Pochipp enabled

Discovery Timeline

2026-09-19 - CVE-2026-92967 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-92967

Vulnerability Analysis

The vulnerability resides in the Pochipp Thickbox search interface, specifically in inc/thickbox.php and inc/thickbox/serach_items.php. The plugin reads the keyword value from $_GET, applies sanitize_text_field(), and then interpolates the result directly into the value attribute of an HTML input element via a PHP heredoc block. Because sanitize_text_field() strips HTML tags but does not encode double quotes, an attacker can break out of the attribute context and inject arbitrary event handlers or script markup. The reflected payload executes in the browser of any authenticated user who follows a crafted link to the affected admin endpoint.

Root Cause

The root cause is missing contextual output encoding. sanitize_text_field() is an input-normalization function, not an HTML-attribute escaper. WordPress requires esc_attr() for values placed inside HTML attribute contexts. Because the plugin omits esc_attr() in the heredoc that renders the search input, unescaped double quotes and event handlers pass through to the rendered DOM.

Attack Vector

Exploitation requires user interaction. An unauthenticated attacker crafts a URL targeting /wp-admin/media-upload.php with a malicious keyword payload containing a double-quote break-out and JavaScript event handler. The attacker delivers the URL via phishing, forum post, or chat message. When a WordPress user with Author-level privileges or higher clicks the link while authenticated, the payload reflects into the search input's value attribute and executes. Because the scope changes across security boundaries (browser to WordPress admin), the attacker can perform any action the victim is authorized to perform.

No verified proof-of-concept code is published. Refer to the Wordfence Vulnerability Report and the affected Thickbox source for technical details.

Detection Methods for CVE-2026-92967

Indicators of Compromise

HTTP GET requests to /wp-admin/media-upload.php containing a keyword parameter with URL-encoded double quotes, angle brackets, or on*= event-handler substrings
Referrer chains showing external origins directing authenticated Author-or-above users into media-upload.php with query parameters
Unexpected outbound requests from admin browser sessions to attacker-controlled domains shortly after loading the Pochipp Thickbox interface

Detection Strategies

Inspect web server access logs for the keyword query parameter containing suspicious character sequences such as %22, %3Cscript, onerror=, or onload=
Deploy Web Application Firewall (WAF) rules to flag reflected XSS patterns targeting Pochipp Thickbox endpoints
Correlate WordPress audit logs for administrative actions immediately following inbound clicks from external referrers

Monitoring Recommendations

Alert on any wp-admin/media-upload.php request whose keyword parameter contains characters outside a permitted allowlist for search terms
Monitor Content Security Policy (CSP) violation reports for inline script execution on admin pages
Track creation of new administrator accounts, plugin installations, or theme file edits that follow suspicious admin session activity

How to Mitigate CVE-2026-92967

Immediate Actions Required

Update the Pochipp plugin to the version released after 1.20.2 that addresses the flaw, per the WordPress plugin changeset
Restrict Author-or-above account creation and enforce phishing-awareness training for users holding upload_files capability
Deploy a strict Content Security Policy that disallows inline scripts on /wp-admin/ endpoints

Patch Information

The vendor addressed the vulnerability in the version following 1.20.2. The fix wraps the reflected keyword value with esc_attr() before interpolating it into the HTML attribute context. Site administrators should apply the update through the WordPress plugin dashboard or via WP-CLI (wp plugin update pochipp). Confirm the installed version in wp-admin/plugins.php after upgrade.

Workarounds

Temporarily deactivate the Pochipp plugin until the patched version is installed
Block or challenge requests to /wp-admin/media-upload.php containing non-alphanumeric characters in the keyword parameter at the WAF layer
Reduce the number of accounts assigned Author or higher roles to shrink the exploitation surface

bash

# Example WAF rule (ModSecurity) to block suspicious keyword payloads
SecRule REQUEST_URI "@contains /wp-admin/media-upload.php" \
  "chain,phase:2,deny,status:403,id:1092967,\
  msg:'CVE-2026-92967 Pochipp Reflected XSS attempt'"
  SecRule ARGS:keyword "@rx (?i)(<script|on\w+\s*=|\"|%22|javascript:)" \
    "t:none,t:urlDecodeUni"