CVE-2026-1573: 
WordPress vulnerability analysis and mitigation

CVE-2026-1573 is a Stored Cross-Site Scripting (XSS) vulnerability in the OMIGO plugin for WordPress, affecting all versions up to and including 3.3. The flaw exists in the omigo_donate_button shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. It was published on February 7, 2026, and assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), stemming from the plugin's failure to sanitize and escape user-supplied attributes passed to the omigo_donate_button shortcode before rendering them in HTML output (Wordfence). The attack vector is network-based and requires low privileges (contributor-level WordPress account or above), with no user interaction required for the script to execute once injected. The vulnerable code path can be reviewed in the plugin source at the relevant line in omigo.php (OMIGO Plugin Source).

Successful exploitation allows an authenticated attacker with at least contributor-level access to inject persistent malicious JavaScript into WordPress pages. Any user — including administrators — who visits an injected page will have the script execute in their browser, potentially enabling session cookie theft, credential harvesting, unauthorized administrative actions, or further site compromise. The scope is changed (affecting users beyond the attacker's own session), with low confidentiality and integrity impacts and no direct availability impact (Wordfence, ENISA EUVD).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-1573 as of the available data. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account with at least contributor-level access, which limits the attacker pool compared to unauthenticated vulnerabilities (Wordfence).

1. Gain Contributor Access: Obtain or register a WordPress account with at least contributor-level privileges on a target site running OMIGO plugin version ≤ 3.3.
2. Create or Edit a Post: Navigate to the WordPress post editor and create or edit a post/page where the omigo_donate_button shortcode can be inserted.
3. Inject Malicious Payload: Insert the shortcode with a crafted attribute containing a JavaScript payload, for example: [omigo_donate_button attribute="\" onmouseover=\"alert(document.cookie)\""] or a similar XSS vector targeting unsanitized attributes.
4. Publish the Content: Submit or publish the post so the injected shortcode is stored in the database and rendered on the page.
5. Trigger Execution: When any site visitor (including administrators) loads the injected page, the malicious script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, OMIGO Plugin Source).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints from contributor-level accounts containing shortcode attributes with JavaScript event handlers (e.g., onerror, onmouseover, onfocus) or <script> tags.
• Database: Unexpected JavaScript payloads stored in the wp_posts table within omigo_donate_button shortcode attributes.
• Network: Outbound requests from victim browsers to attacker-controlled domains (e.g., for cookie exfiltration) originating after page loads containing the OMIGO shortcode.
• File System: No direct file system artifacts expected for this stored XSS; focus monitoring on database content and server-side logs.

WordPress site administrators should update the OMIGO plugin to a version beyond 3.3 that includes proper input sanitization and output escaping fixes, once a patched release is available from the plugin vendor (omi-mexico). In the interim, restrict contributor-level and above account creation to trusted users, and consider disabling the OMIGO plugin until a patch is confirmed. Web Application Firewalls (WAFs) with XSS filtering rules can provide additional mitigation against exploitation attempts (Wordfence).

Wordfence disclosed and assigned this CVE as part of their weekly WordPress vulnerability report for the period of February 2–8, 2026, highlighting it among other plugin vulnerabilities (Wordfence Blog). No significant broader media coverage or notable researcher commentary beyond standard vulnerability aggregation has been identified for this CVE.