CVE-2026-2687: 
WordPress vulnerability analysis and mitigation

CVE-2026-2687 is a Stored Cross-Site Scripting (XSS) vulnerability in the Reading progressbar WordPress plugin affecting versions before 1.3.1. The flaw allows high-privilege users (admin-level) to inject and store malicious scripts via unsanitized plugin settings, even when the unfiltered_html capability is disabled — a scenario common in WordPress multisite environments. It was publicly disclosed on February 19, 2026, and assigned a CVSS v3.1 base score of 4.3 (Low/Medium) by Feedly, with WPScan reporting a CVSS of 3.5 (Low) (WPScan, Feedly).

The root cause is improper neutralization of user-supplied input in plugin settings fields (CWE-79). Specifically, the plugin fails to sanitize or escape values stored in the "Progressbar height (pixels)" and "Target fixed HTML element class/id to stick the bar on it's bottom" settings fields before rendering them in the browser. An attacker with admin privileges can inject a crafted payload such as ' style='animation-name:rotation' onanimationstart='alert(/XSS/)//' into these fields; when the page is loaded by any user, the stored script executes in their browser context. The vulnerability bypasses the unfiltered_html capability restriction, making it particularly relevant in WordPress multisite setups where that capability is typically restricted (WPScan).

Successful exploitation allows a malicious or compromised administrator to persistently inject JavaScript that executes in the browsers of other users visiting affected pages. In a WordPress multisite environment, this could enable session hijacking, credential theft, defacement, or redirection of users to malicious sites. While the attacker must already hold admin-level access, the bypass of unfiltered_html restrictions means the attack surface extends to environments where such controls are expected to provide a security boundary (WPScan, Feedly).

No public exploit kit integration or in-the-wild exploitation has been reported for this vulnerability. A proof-of-concept payload is publicly documented in the WPScan advisory. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated admin-level access, significantly limiting the attack surface (WPScan, Feedly).

1. Gain Admin Access: Obtain administrator credentials for the target WordPress site (e.g., via credential stuffing, phishing, or a separate vulnerability).
2. Navigate to Plugin Settings: Log in to the WordPress admin dashboard and navigate to the Reading progressbar plugin settings page.
3. Inject XSS Payload: Enter the following payload into the "Progressbar height (pixels)" or "Target fixed HTML element class/id" field: ' style='animation-name:rotation' onanimationstart='alert(/XSS/)//'
4. Save Settings: Save the plugin configuration, causing the malicious payload to be stored in the WordPress database without sanitization.
5. Trigger Execution: When any user (including non-admin users) visits a page where the Reading progressbar plugin renders its output, the stored payload executes in their browser, enabling session theft, credential harvesting, or further attacks (WPScan).

• Logs: WordPress admin audit logs showing changes to Reading progressbar plugin settings by an admin account, particularly if unexpected or outside normal maintenance windows.
• Database: Presence of JavaScript event handlers (e.g., onanimationstart, onerror, onload) or <script> tags within the reading-progress-bar plugin option values in the wp_options table.
• Network: Outbound requests from user browsers to unknown external domains shortly after loading pages with the progressbar widget, potentially indicating data exfiltration via injected scripts.
• Browser/Client: Unexpected JavaScript alerts or redirects experienced by site visitors on pages where the Reading progressbar plugin is active (WPScan).

Update the Reading progressbar WordPress plugin to version 1.3.1 or later, which includes proper sanitization and escaping of the affected settings fields. No configuration-based workaround is available; upgrading is the only effective remediation. Site administrators should also audit plugin settings for any previously stored malicious payloads and review admin account activity for unauthorized changes (WPScan).

The vulnerability was discovered and reported by researcher Krugov Artyom via CleanTalk's security research team and verified by WPScan. Wordfence included it in their weekly WordPress vulnerability report for the week of March 9–15, 2026. Coverage has been limited to standard vulnerability aggregation platforms and security feeds, with no significant broader media or community discussion noted (WPScan, Wordfence).