CVE-2026-9577: Post Status Notifier Lite XSS Vulnerability

CVE-2026-9577 Overview

CVE-2026-9577 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Post Status Notifier Lite WordPress plugin versions prior to 1.13.0. The plugin fails to properly escape the mod URL parameter before reflecting it into the admin settings page at admin.php?page=post-status-notifier-lite. An attacker who tricks an authenticated administrator into clicking a crafted URL can execute arbitrary JavaScript in the administrator's browser session. The payload runs with the privileges of the targeted admin account, enabling account takeover paths on affected WordPress sites.

Critical Impact
Attackers can hijack administrator sessions, create rogue admin accounts, or inject persistent backdoors when an admin follows a crafted link.

Affected Products

Post Status Notifier Lite WordPress plugin versions before 1.13.0
WordPress installations with the plugin activated
Administrator accounts accessing the plugin settings page

Discovery Timeline

2026-07-23 - CVE-2026-9577 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-9577

Vulnerability Analysis

The vulnerability resides in the admin settings page handler for the Post Status Notifier Lite plugin. The plugin reads the mod query string parameter from the request URL and writes its value into the rendered HTML of the admin page without applying output escaping. Because the parameter value is reflected directly into the response, an attacker can inject HTML and JavaScript that the browser will parse and execute.

Exploitation requires the victim to be an authenticated WordPress administrator who follows a URL controlled by the attacker. The injected script executes in the admin origin, giving the attacker full access to any action the administrator can perform through the WordPress dashboard.

Root Cause

The root cause is missing output escaping on user-controlled input [CWE-79]. The plugin does not pass the mod parameter through WordPress escaping functions such as esc_attr(), esc_html(), or esc_url() before rendering. This allows arbitrary characters, including <, >, and quote characters, to break out of the intended HTML context.

Attack Vector

The attack vector is a crafted link delivered by phishing, social media, or an untrusted referrer. When the administrator clicks the link while logged in, the mod parameter payload is reflected into the settings page and executed. The script can issue authenticated requests to WordPress REST endpoints, create new administrator users, modify plugin or theme files, and exfiltrate session cookies not protected by HttpOnly. The vulnerability requires user interaction and does not trigger without an active admin session.

See the WPScan Vulnerability Details advisory for additional technical context.

Detection Methods for CVE-2026-9577

Indicators of Compromise

Web server access logs showing requests to admin.php?page=post-status-notifier-lite with suspicious values in the mod parameter, such as <script, onerror=, or URL-encoded equivalents like %3Cscript.
Unexpected creation of WordPress administrator accounts or modifications to wp_users and wp_usermeta tables shortly after an admin visited a crafted link.
New or modified plugin, theme, or mu-plugins files with timestamps aligned to the suspicious request.

Detection Strategies

Deploy web application firewall rules that inspect the mod query parameter for HTML tags, event handlers, and JavaScript URI schemes.
Correlate outbound HTTP requests from admin browsers to unknown domains immediately following visits to the plugin settings page.
Audit the installed version of Post Status Notifier Lite across all managed WordPress sites and flag any release earlier than 1.13.0.

Monitoring Recommendations

Enable WordPress audit logging to record admin URL access, user role changes, and plugin or theme file writes.
Forward web server and WordPress audit logs to a centralized SIEM for query and alerting on the indicator patterns above.
Alert on any administrator session that performs privilege changes within seconds of loading admin.php?page=post-status-notifier-lite.

How to Mitigate CVE-2026-9577

Immediate Actions Required

Update the Post Status Notifier Lite plugin to version 1.13.0 or later on all WordPress sites.
Instruct administrators not to click links to the plugin settings page from untrusted sources until patching is complete.
Rotate administrator passwords and invalidate active sessions if suspicious requests to the vulnerable endpoint appear in logs.

Patch Information

The vendor has released Post Status Notifier Lite version 1.13.0, which adds proper escaping of the mod URL parameter before reflection. Refer to the WPScan Vulnerability Details advisory for the fixed release reference.

Workarounds

Deactivate and remove the Post Status Notifier Lite plugin until the patched version can be installed.
Restrict access to /wp-admin/admin.php by IP allowlist at the web server or WAF layer to reduce exposure of admin endpoints.
Configure a Content Security Policy that disallows inline scripts on the WordPress admin origin to limit the impact of reflected payloads.

bash

# Example WAF rule concept blocking script payloads in the mod parameter
# ModSecurity rule
SecRule ARGS:mod "@rx (?i)(<script|onerror=|javascript:)" \
    "id:1009577,phase:2,deny,status:403,\
    msg:'CVE-2026-9577 Post Status Notifier Lite XSS attempt'"