CVE-2026-2718: 
WordPress vulnerability analysis and mitigation

CVE-2026-2718 is a Stored Cross-Site Scripting (XSS) vulnerability in the Dealia – Request a Quote plugin for WordPress, affecting all versions up to and including 1.0.8. The flaw arises from the use of wp_kses() for output escaping in HTML attribute contexts where esc_attr() is required, allowing injection of arbitrary web scripts via Gutenberg block attributes. It was published on February 19, 2026, and carries a CVSS v3.1 base score of 6.4 (Medium) (Red Hat CVE, Wordfence).

The root cause is improper neutralization of input during web page generation (CWE-79). Specifically, the plugin incorrectly uses wp_kses() — a function designed for sanitizing HTML content — in HTML attribute contexts, where esc_attr() is the appropriate escaping function. This mismatch allows specially crafted attribute values in Gutenberg block parameters to bypass sanitization and persist malicious JavaScript in the database. Exploitation requires an authenticated attacker with at least Contributor-level access to create or edit posts containing the vulnerable block (Red Hat CVE, Wordfence).

Successful exploitation allows an authenticated attacker to store malicious JavaScript that executes in the browsers of any user — including administrators — who visits a page containing the injected block. This can lead to session hijacking, credential theft, unauthorized administrative actions (such as creating rogue admin accounts or installing backdoors), and defacement. The changed scope (S:C) in the CVSS vector reflects that the impact extends beyond the attacker's own session to affect other users of the WordPress site (Red Hat CVE).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.032%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for Contributor-level authentication, limiting the attacker pool to registered users of the target WordPress site (Red Hat CVE, Wordfence).

1. Reconnaissance: Identify WordPress sites running the Dealia – Request a Quote plugin version 1.0.8 or earlier. This can be done by checking plugin readme files exposed at /wp-content/plugins/dealia/readme.txt or using web scanning tools.
2. Obtain Contributor access: Register or compromise an account with at least Contributor-level privileges on the target WordPress site.
3. Create or edit a post: Navigate to the WordPress block editor and insert a Dealia – Request a Quote Gutenberg block into a new or existing post/page.
4. Inject malicious payload: Craft a block attribute value containing a JavaScript payload that bypasses wp_kses() but is not properly escaped in the HTML attribute context, e.g., " onmouseover="alert(document.cookie) or a more sophisticated payload to exfiltrate session cookies.
5. Publish the content: Save and publish the post. The malicious script is now stored in the database.
6. Trigger execution: When any user (including an administrator) visits the page, the injected script executes in their browser, enabling session hijacking, credential theft, or further exploitation (Wordfence).

• Logs: WordPress access logs showing POST requests to /wp-json/wp/v2/posts or the block editor save endpoint from Contributor-level accounts containing unusual HTML attribute patterns (e.g., event handlers like onerror=, onmouseover=, or javascript: URIs).
• Database: Suspicious entries in the wp_posts or wp_postmeta tables containing JavaScript event handlers or encoded script payloads within Dealia block attributes.
• Network: Outbound requests from victim browsers to attacker-controlled domains following page visits, potentially carrying session tokens or cookies.
• File System: Unexpected new plugin or theme files, or modifications to functions.php, which may indicate follow-on compromise after admin session hijacking.

Users should update the Dealia – Request a Quote plugin to a version beyond 1.0.8 that addresses this vulnerability. If no patched version is yet available, site administrators should restrict Contributor-level user registration and limit the ability of untrusted users to publish or edit posts containing Gutenberg blocks. Additionally, deploying a Web Application Firewall (WAF) with XSS filtering rules — such as those provided by Wordfence — can help detect and block exploitation attempts (Wordfence).

Wordfence included this vulnerability in their weekly WordPress vulnerability report for the period of February 16–22, 2026, as part of routine community disclosure (Wordfence). No significant independent researcher commentary, vendor statements beyond the CVE record, or notable media coverage has been identified for this vulnerability.