CVE-2026-93622: WPS Limit Login XSS Vulnerability

CVE-2026-93622 Overview

CVE-2026-93622 is an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting the WPS Limit Login WordPress plugin in versions 1.5.9.3 and earlier. The flaw is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation). An unauthenticated attacker can inject malicious script content that executes in the browser of a victim who interacts with a crafted request. Because exploitation crosses the trust boundary between the plugin context and the surrounding page (scope change), successful attacks can affect site administrators and other privileged users.

Critical Impact
An unauthenticated attacker can execute arbitrary JavaScript in the victim's browser session, enabling session hijacking, credential theft, or takeover of WordPress administrator accounts through crafted links.

Affected Products

WPS Limit Login WordPress plugin versions <= 1.5.9.3
WordPress sites where the vulnerable plugin is installed and active
Any user-facing or authenticated pages rendering the vulnerable plugin output

Discovery Timeline

2026-09-23 - CVE-2026-93622 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-93622

Vulnerability Analysis

The vulnerability is a reflected or stored Cross-Site Scripting (XSS) issue in the WPS Limit Login plugin. Input supplied through the network attack surface is rendered in an HTML response without sufficient neutralization of script-related characters. Because the attack requires user interaction (UI:R) and results in a scope change (S:C), payloads delivered via a crafted URL or form submission execute within the trusted context of the WordPress site.

Successful exploitation permits limited compromise of confidentiality, integrity, and availability. Attackers commonly leverage this class of flaw to steal authentication cookies, perform administrative actions on behalf of a logged-in user, or pivot to further attacks such as plugin installation or account creation.

Root Cause

The root cause is improper output encoding of user-controllable input within the plugin's request handling. Data reaching a rendering path is not passed through WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses() before being written to the HTML response. This allows attacker-supplied markup, including <script> tags and event handler attributes, to be interpreted by the browser.

Attack Vector

Exploitation occurs over the network without authentication. An attacker crafts a URL or request containing a JavaScript payload targeting a vulnerable parameter processed by the plugin. The attacker then lures a victim, typically an authenticated site administrator, to visit the link. When the page renders, the payload executes in the victim's browser under the site's origin.

No verified proof-of-concept code is available for CVE-2026-93622. Consult the Patchstack XSS Vulnerability Advisory for additional technical detail as it becomes available.

Detection Methods for CVE-2026-93622

Indicators of Compromise

Web server access logs containing request parameters with <script>, javascript:, onerror=, or onload= substrings targeting WPS Limit Login endpoints.
URL-encoded payloads such as %3Cscript%3E or %3Cimg%20src%3D appearing in query strings or POST bodies handled by the plugin.
Unexpected administrator account creation, plugin installation, or option changes shortly after an admin visited an externally supplied link.

Detection Strategies

Inspect WordPress request logs for anomalous parameter values referencing WPS Limit Login handlers and containing HTML or JavaScript syntax.
Deploy a Web Application Firewall (WAF) rule set to flag reflected XSS patterns against WordPress plugin endpoints.
Monitor browser Content Security Policy (CSP) violation reports for inline script execution originating from plugin-rendered pages.

Monitoring Recommendations

Alert on new WordPress wp_users entries with administrator role granted outside of change-control windows.
Track edits to wp_options values such as siteurl, home, and active_plugins for unauthorized modifications.
Correlate outbound HTTP requests from admin browser sessions to unknown domains, indicating potential cookie exfiltration.

How to Mitigate CVE-2026-93622

Immediate Actions Required

Update the WPS Limit Login plugin to a version above 1.5.9.3 as soon as a fixed release is published by the vendor.
Deactivate and remove the WPS Limit Login plugin if a patched version is not yet available and an alternative login-protection plugin can be substituted.
Force password resets and invalidate active sessions for all WordPress administrator accounts that may have visited attacker-controlled links.

Patch Information

Refer to the Patchstack XSS Vulnerability Advisory for the current patched version and vendor guidance. Apply updates through the WordPress plugin manager or by replacing plugin files with the fixed release. Verify the installed version reports higher than 1.5.9.3 after upgrade.

Workarounds

Deploy a WAF policy that blocks requests containing HTML or JavaScript syntax in parameters processed by the WPS Limit Login plugin.
Enforce a strict Content Security Policy (CSP) on the WordPress site that disallows inline scripts and restricts script sources to trusted origins.
Restrict administrative access to the WordPress dashboard using IP allowlists or VPN-only access to reduce the attack surface for admin-targeted XSS lures.

bash

# Configuration example: restrict wp-admin access via nginx allowlist
location ^~ /wp-admin/ {
    allow 203.0.113.0/24;   # trusted admin network
    deny all;
    try_files $uri $uri/ /index.php?$args;
}

# Example CSP header to mitigate reflected XSS execution
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;