CVE-2026-3005: 
WordPress vulnerability analysis and mitigation

CVE-2026-3005 is a Stored Cross-Site Scripting (XSS) vulnerability in the List Category Posts plugin for WordPress, affecting all versions up to and including 0.94.0. The flaw exists in the plugin's catlist shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. It was published on April 9, 2026, with a patch made available the same day. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium), assigned by Wordfence (GitHub Advisory, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). Specifically, the vulnerability resides in lcp-thumbnail.php at line 95, where user-supplied attributes passed to the catlist shortcode are not properly sanitized before being rendered in page output (GitHub Advisory, WordPress Trac). An authenticated attacker with at minimum contributor-level access can craft a malicious catlist shortcode containing embedded JavaScript, which is then stored in the database and executed in the browser of any user who views the affected page. No user interaction beyond page visitation is required for the payload to execute, and the attack vector is network-accessible.

Successful exploitation allows authenticated contributors to persistently inject arbitrary JavaScript into WordPress pages, which executes in the context of any visitor's browser session. This can lead to session token theft, credential harvesting, content defacement, unauthorized actions performed on behalf of victims, or redirection to malicious sites. The changed scope in the CVSS rating reflects that the impact extends beyond the attacker's own session to affect all users visiting the compromised page (GitHub Advisory, Wordfence).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.029–0.037%, placing it in the 11th percentile for exploitation likelihood within 30 days (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a contributor-level WordPress account, which limits the attack surface compared to unauthenticated vulnerabilities.

1. Reconnaissance: Identify WordPress sites running the List Category Posts plugin at version 0.94.0 or earlier using tools like WPScan or by inspecting plugin metadata in publicly accessible readme.txt files.
2. Obtain contributor access: Register or compromise a WordPress account with at least contributor-level privileges on the target site.
3. Craft malicious shortcode: Create or edit a post/page and insert a catlist shortcode with a malicious attribute containing a JavaScript payload, e.g., [catlist thumbnail_size="<img src=x onerror=alert(document.cookie)>"].
4. Submit and store payload: Publish or save the post/page. The unsanitized attribute value is stored in the WordPress database without proper escaping.
5. Trigger execution: When any user (including administrators) visits the page containing the injected shortcode, the malicious script executes in their browser, potentially exfiltrating session cookies or performing actions on their behalf (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints from contributor-level accounts containing encoded script tags or event handler attributes (e.g., onerror, onload, <script>) within shortcode parameters.
• Database: Suspicious entries in the wp_posts or wp_postmeta tables containing catlist shortcodes with HTML/JavaScript payloads in attribute values.
• Network: Outbound requests from victim browsers to unknown external domains shortly after loading pages containing catlist shortcodes, potentially indicating data exfiltration.
• File System: Unexpected modifications to plugin files in wp-content/plugins/list-category-posts/, particularly include/lcp-thumbnail.php, if an attacker escalated access to modify plugin code directly.

The primary remediation is to update the List Category Posts plugin to a version beyond 0.94.0, which includes the fix applied in changeset 3482733 (WordPress Trac). Site administrators should also audit existing posts and pages for suspicious catlist shortcode attributes and remove any malicious content. As interim measures, restrict contributor-level access to trusted users only, deploy a Web Application Firewall (WAF) to filter script injection attempts, and implement Content Security Policy (CSP) headers to reduce the impact of any injected scripts (Wordfence).

Wordfence disclosed and reported the vulnerability, publishing it in their threat intelligence database on April 9, 2026 (Wordfence). The vulnerability was included in Wordfence's weekly WordPress vulnerability report for April 6–12, 2026, and was also covered in Sucuri's April 2026 vulnerability patch roundup (Wordfence Blog, Sucuri Blog). No significant independent researcher commentary or broader media coverage has been identified beyond standard vulnerability aggregation.