CVE-2026-1575: 
WordPress vulnerability analysis and mitigation

CVE-2026-1575 is a Stored Cross-Site Scripting (XSS) vulnerability in the Schema Shortcode plugin for WordPress, affecting all versions up to and including 1.0. The flaw exists in the plugin's itemscope shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. It was published on March 21, 2026, and assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (Red Hat CVE, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), stemming from the plugin's failure to sanitize user-supplied attributes passed to the itemscope shortcode before rendering them in page output. An authenticated attacker with at least contributor-level access can craft a malicious shortcode containing arbitrary JavaScript, which is then stored in the WordPress database and executed in the browser of any user who visits the affected page. The vulnerable code path is visible in the plugin source at schema-shortcode.php line 41 (Wordfence, Plugin Source).

Successful exploitation allows an attacker to inject persistent malicious scripts into WordPress pages, which execute in the context of any visitor's browser — including administrators. This can lead to session cookie theft, credential harvesting, unauthorized administrative actions (such as creating rogue admin accounts), defacement, or redirection to malicious sites. The changed scope (S:C) in the CVSS vector indicates the impact extends beyond the plugin itself to the broader WordPress site and its users (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-1575 as of the latest available data. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability requires authenticated access at contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities. It does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the Schema Shortcode plugin version 1.0 or earlier. This can be done by checking the plugin's readme or changelog exposed at /wp-content/plugins/schema-shortcode/readme.txt.
2. Obtain contributor access: Register or compromise an account with at least contributor-level privileges on the target WordPress site.
3. Craft malicious shortcode: Create or edit a post/page and insert a malicious itemscope shortcode with an unsanitized attribute containing a JavaScript payload, e.g., [itemscope itemtype="\" onmouseover=\"alert(document.cookie)\""].
4. Submit and store: Publish or save the post/page. The malicious script is stored in the WordPress database without sanitization.
5. Trigger execution: When any user (including an administrator) visits the injected page, the browser renders the unsanitized attribute and executes the injected JavaScript, enabling session hijacking, credential theft, or further exploitation (Wordfence, Plugin Source).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API from contributor-level accounts containing shortcode content with suspicious HTML attributes (e.g., onmouseover, onerror, <script>).
• Database: Entries in the wp_posts table containing [itemscope shortcodes with embedded JavaScript event handlers or <script> tags in post content.
• Network: Outbound requests from victim browsers to unknown external domains (e.g., for cookie exfiltration) originating from pages containing the Schema Shortcode plugin output.
• File System: Unexpected modifications to plugin files under /wp-content/plugins/schema-shortcode/ that may indicate further tampering after initial XSS exploitation.

WordPress site administrators should immediately update the Schema Shortcode plugin beyond version 1.0 if a patched release becomes available from the plugin author (jeric_izon). If no patch is available, the recommended workaround is to deactivate and remove the plugin entirely until a fix is released. Additionally, restrict contributor-level user registrations and review existing contributor accounts for unauthorized activity. Implementing a Web Application Firewall (WAF) with XSS filtering rules can provide an additional layer of defense (Wordfence).