CVE-2026-0916: 
WordPress vulnerability analysis and mitigation

CVE-2026-0916 is a Stored Cross-Site Scripting (XSS) vulnerability in the Related Posts by Taxonomy plugin for WordPress. It affects all versions up to and including 2.7.6, and was disclosed on January 16, 2026, by Wordfence. The flaw exists in the plugin's related_posts_by_tax shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. It carries a CVSS v3.1 base score of 6.4 (Medium), assigned by Wordfence (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). The root cause is insufficient sanitization of user-supplied shortcode attributes in the related_posts_by_tax shortcode, combined with a lack of proper output escaping when rendering those attributes in generated HTML. The vulnerable code path is identifiable in includes/functions.php at line 259 of the 2.7.6 plugin release. An authenticated attacker with at least contributor-level access can embed a malicious shortcode in a post or page, and the injected script executes in the browsers of all subsequent visitors (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated contributor (or higher-privileged user) to persistently inject arbitrary JavaScript into WordPress pages, which executes in the context of any visitor's browser. This can lead to session cookie theft, credential harvesting, defacement, redirection to malicious sites, or further attacks against site administrators — potentially enabling full site takeover if an admin account is compromised. Confidentiality and integrity are both impacted (low severity each per CVSS), while availability is not directly affected (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence, Red Hat CVE).

1. Gain Contributor Access: Register or compromise a WordPress account with at least contributor-level privileges on a target site running Related Posts by Taxonomy version 2.7.6 or earlier.
2. Create or Edit a Post: Navigate to the WordPress post editor and create or edit a post/page where shortcodes are rendered.
3. Inject Malicious Shortcode: Insert the related_posts_by_tax shortcode with a crafted attribute containing a JavaScript payload, for example: [related_posts_by_tax attribute="\"onmouseover=\"alert(document.cookie)"] or a similar XSS vector exploiting unsanitized attribute output.
4. Publish the Content: Submit or publish the post so the injected shortcode is stored in the WordPress database.
5. Trigger Execution: When any user (including administrators) visits the affected page, the injected script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API containing related_posts_by_tax shortcode with unusual attribute values including JavaScript event handlers (e.g., onerror, onmouseover, onfocus) or <script> tags.
• Database: WordPress wp_posts table entries containing the related_posts_by_tax shortcode with embedded JavaScript payloads in shortcode attributes.
• Network: Outbound requests from victim browsers to attacker-controlled domains following page visits, potentially visible in web proxy or firewall logs.
• File System: No direct file system artifacts expected for this stored XSS, but review plugin files in wp-content/plugins/related-posts-by-taxonomy/ for unauthorized modifications.

Users should update the Related Posts by Taxonomy plugin to version 2.7.7 or later, which includes the fix for insufficient input sanitization and output escaping in the related_posts_by_tax shortcode. The patched code is visible in includes/functions.php at line 259 of the 2.7.7 release. As a temporary workaround, site administrators can restrict contributor-level users from publishing content without review, or disable the plugin until patching is feasible (Wordfence, WordPress Trac).

Wordfence published the vulnerability in their weekly WordPress vulnerability report covering January 12–18, 2026, and included it in their threat intelligence database (Wordfence Weekly Report). The vulnerability was also noted by Spanish national cybersecurity agencies INCIBE-CERT and CCN-CERT in their early warning bulletins. No significant broader media coverage or notable researcher commentary beyond standard vulnerability tracking has been observed.