CVE-2026-1795: 
WordPress vulnerability analysis and mitigation

CVE-2026-1795 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Address Bar Ads plugin for WordPress, affecting all versions up to and including 1.0.0. The flaw stems from insufficient input sanitization and output escaping of the URL path parameter, allowing unauthenticated attackers to inject arbitrary web scripts. It was published on February 14, 2026, and carries a CVSS v3.1 base score of 6.1 (Medium) (Red Hat CVE, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The Address Bar Ads plugin fails to properly sanitize user-supplied URL path input before reflecting it in the generated page output, enabling script injection. Exploitation requires social engineering — an attacker must craft a malicious URL and trick a victim into clicking it, at which point the injected script executes in the victim's browser within the context of the WordPress site (Red Hat CVE, Infinitsec).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session on the affected WordPress site. This can lead to session cookie theft, credential harvesting, redirection to malicious sites, or defacement of page content as seen by the victim. Confidentiality and integrity are both assessed as low-impact, and availability is not affected; however, the changed scope indicates the impact crosses the security boundary of the vulnerable component (Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.082%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction, limiting its practical impact compared to unauthenticated, interaction-free vulnerabilities (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Address Bar Ads plugin version 1.0.0 or earlier using tools like WPScan or by inspecting plugin directories on publicly accessible WordPress installations.
2. Craft malicious URL: Construct a URL targeting the vulnerable WordPress site that includes a malicious JavaScript payload within the URL path parameter processed by the Address Bar Ads plugin (e.g., https://victim-site.com/<script>malicious_payload</script>).
3. Deliver the link: Send the crafted URL to a target user via phishing email, social media message, or other social engineering vector to induce them to click the link.
4. Script execution: When the victim visits the crafted URL, the WordPress page reflects the unsanitized URL path into the HTML output, causing the injected script to execute in the victim's browser under the site's origin.
5. Achieve objective: The executed script can steal session cookies, capture credentials, redirect the user to a phishing page, or perform actions on behalf of the victim within the WordPress site (Infinitsec).

• Network: HTTP requests to WordPress pages with unusual or encoded script tags (<script>, %3Cscript%3E, javascript:) embedded in the URL path; outbound requests from victim browsers to attacker-controlled domains following page load.
• Logs: WordPress or web server access logs showing GET requests with script-like patterns in the URL path (e.g., paths containing <script>, onerror=, onload=, or URL-encoded equivalents).
• Browser/Client: Unexpected redirects or pop-ups experienced by users after clicking links purportedly pointing to the affected WordPress site.

The primary remediation is to update the Address Bar Ads plugin to a version beyond 1.0.0 that includes proper input sanitization and output escaping, once a patched release is made available by the plugin author. In the interim, site administrators should consider deactivating and removing the Address Bar Ads plugin entirely if it is not essential. Additionally, deploying a Web Application Firewall (WAF) — such as Wordfence — can help detect and block reflected XSS payloads targeting WordPress sites (Wordfence).

Wordfence included this vulnerability in their weekly WordPress vulnerability report for February 9–15, 2026, flagging it as part of routine plugin security monitoring (Wordfence). Infinitsec published a brief technical post detailing the vulnerability (Infinitsec). No significant broader media coverage or notable researcher commentary beyond these standard disclosure channels has been observed.