CVE-2026-1608: 
WordPress vulnerability analysis and mitigation

CVE-2026-1608 is a Stored Cross-Site Scripting (XSS) vulnerability in the Video Onclick plugin for WordPress, affecting all versions up to and including 0.4.7. The flaw arises from insufficient input sanitization and output escaping on user-supplied attributes within the plugin's youtube shortcode. Authenticated attackers with contributor-level access or above can inject arbitrary web scripts into pages, which execute whenever any user visits the affected page. It was published on February 7, 2026, and carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically a stored XSS variant. The vulnerable code resides in the plugin's youtube shortcode handler (visible at line 109 of video-onclick.php in version 0.4.7), where user-supplied shortcode attributes are neither sanitized on input nor escaped on output before being rendered in the page HTML. An attacker with at least contributor-level WordPress access can craft a post or page containing a malicious [youtube] shortcode with injected JavaScript, which is then persistently stored in the database and executed in the browsers of all subsequent visitors (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated attacker to persistently inject malicious JavaScript that executes in the context of any user's browser visiting the compromised page, including administrators. This can lead to session cookie theft, credential harvesting, unauthorized actions performed on behalf of victims (including privilege escalation if an admin is targeted), defacement, or redirection to malicious sites. Confidentiality and integrity are both impacted at a low level per the CVSS scoring, with no direct availability impact (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-1608 as of the available data. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Video Onclick plugin version 0.4.7 or earlier, using tools like WPScan or by checking the plugin version in the site's source or /wp-content/plugins/video-onclick/ directory.
2. Obtain contributor access: Register or compromise an account with at least contributor-level privileges on the target WordPress site.
3. Craft malicious shortcode: Create a new post or page and insert a [youtube] shortcode with a malicious attribute value, e.g., [youtube id="\" onmouseover=\"alert(document.cookie)\""] or a more sophisticated payload that exfiltrates session cookies to an attacker-controlled server.
4. Publish or submit content: Submit the post for review or publish it (depending on role permissions). The malicious payload is stored in the WordPress database.
5. Trigger execution: When any user (including administrators) visits the page containing the injected shortcode, the browser renders and executes the injected JavaScript, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing authenticated POST requests to wp-admin/post.php or the REST API containing [youtube shortcode content with unusual attribute values (e.g., event handlers like onerror, onload, onmouseover, or encoded JavaScript).
• Database: WordPress wp_posts table entries containing [youtube shortcode with embedded JavaScript or HTML event attributes in post content.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages with the Video Onclick shortcode, potentially indicating cookie or credential exfiltration.
• File System: Presence of Video Onclick plugin version 0.4.7 or earlier at /wp-content/plugins/video-onclick/video-onclick.php (check plugin version in the file header).

Site administrators should update the Video Onclick plugin to version 0.4.8 or later, which addresses the insufficient sanitization and escaping issues. If an immediate update is not possible, consider disabling the plugin until patching can be performed, or restrict contributor-level post creation to trusted users only. Regularly audit WordPress user roles and limit contributor access to minimize the attack surface (Wordfence, Wordfence Weekly Report).

Wordfence disclosed and reported this vulnerability as part of their weekly WordPress vulnerability intelligence report for the week of February 2–8, 2026, noting the patch availability in version 0.4.8 (Wordfence Weekly Report). No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified.