CVE-2026-1613: 
WordPress vulnerability analysis and mitigation

CVE-2026-1613 is a Stored Cross-Site Scripting (XSS) vulnerability in the Wonka Slide plugin for WordPress, affecting all versions up to and including 1.3.3. The flaw exists in the plugin's list_class shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. It was published on February 7, 2026, and assigned a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The root cause is the failure to sanitize or escape the list_class attribute passed to the plugin's shortcode before rendering it in the page HTML, as visible in the plugin source at admin/class-wonka-slide-build.php line 65. An authenticated attacker with at minimum contributor-level access can embed a malicious shortcode containing arbitrary JavaScript into a post or page; the script then executes in the browser of any visitor who loads that page (Wordfence, WordPress Trac).

Successful exploitation allows a contributor-level (or higher) authenticated attacker to persistently inject malicious JavaScript into WordPress pages, which executes in the context of every visitor's browser session. This can lead to session cookie theft, credential harvesting, redirection to malicious sites, or defacement of site content. The changed scope (S:C) in the CVSS vector reflects that the impact extends beyond the attacker's own session to all users visiting the compromised page (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-1613. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability requires authenticated access at contributor level or above, which limits the attack surface. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence).

1. Gain Contributor Access: Obtain or register a WordPress account with at least contributor-level privileges on a target site running Wonka Slide ≤ 1.3.3.
2. Craft Malicious Shortcode: Create or edit a post/page and insert a shortcode with a malicious list_class attribute, e.g., [wonka_slide list_class="\" onmouseover=\"alert(document.cookie)\""] or a script-injecting payload.
3. Publish the Content: Submit or publish the post/page containing the injected shortcode. The unsanitized attribute value is stored in the WordPress database.
4. Trigger Execution: When any site visitor (including administrators) loads the affected page, the injected JavaScript executes in their browser, enabling session hijacking, credential theft, or further malicious actions (Wordfence, WordPress Trac).

• Logs: WordPress post/page revision history or database entries containing unexpected HTML event handlers (e.g., onerror, onmouseover, onfocus) or <script> tags within list_class shortcode attributes.
• File System: No direct file-system artifacts expected, as the payload is stored in the WordPress database (wp_posts table); database exports showing malformed shortcode attributes in post content.
• Network: Outbound requests from visitor browsers to unfamiliar external domains (e.g., attacker-controlled cookie collectors or redirect URLs) originating from pages using the Wonka Slide shortcode.
• Process/Application: Browser developer console errors or unexpected JavaScript execution on pages containing [wonka_slide] shortcodes; WAF alerts triggered by XSS patterns in rendered page responses.

Users should update the Wonka Slide plugin to version 1.3.4 or later, which addresses the insufficient sanitization and output escaping in the list_class shortcode attribute. As an interim measure, site administrators can restrict contributor-level users from publishing content without editorial review, or temporarily disable the Wonka Slide plugin until the update is applied. Enabling a Web Application Firewall (WAF) with XSS filtering rules can provide additional protection (Wordfence, Wordfence Weekly Report).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability report for February 2–8, 2026, and published a dedicated threat intelligence entry. Spanish national cybersecurity agencies INCIBE-CERT and CCN-CERT also published advisories referencing the CVE. No significant broader media coverage or notable researcher commentary beyond standard disclosure channels has been observed (Wordfence Weekly Report, INCIBE-CERT, CCN-CERT).