CVE-2026-4078: 
WordPress vulnerability analysis and mitigation

CVE-2026-4078 is a Stored Cross-Site Scripting (XSS) vulnerability in the ITERAS plugin for WordPress, affecting all versions up to and including 1.8.2. The flaw exists in multiple shortcodes (iteras-ordering, iteras-signup, iteras-paywall-login, iteras-selfservice) due to insufficient input sanitization in the combine_attributes() function. It was published on April 24, 2026, with a patch available in version 1.8.3. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (GitHub Advisory, Wordfence).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically in the combine_attributes() function within iteras-public.php. At line 489, the function directly concatenates shortcode attribute values into JavaScript code inside <script> tags using double-quoted string interpolation ('"'.$key.'": "'.$value.'"') without any escaping or sanitization. An attacker can break out of the JavaScript string context by embedding a double-quote character in a shortcode attribute value, allowing injection of arbitrary JavaScript. Exploitation requires at minimum Contributor-level authentication on the WordPress site (GitHub Advisory, Wordfence).

Successful exploitation allows authenticated attackers with Contributor-level access or above to persistently inject malicious JavaScript into WordPress pages, which executes in the browsers of any user who visits the affected page. This can lead to session hijacking, credential theft, malware distribution, or site defacement. The scope is changed (per CVSS), meaning the injected script can affect resources beyond the plugin itself, impacting all site visitors (GitHub Advisory, Wordfence).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires authenticated access at the Contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities. The EPSS score is approximately 0.042–0.055%, placing it in the lower percentiles for near-term exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Wordfence).

1. Reconnaissance: Identify WordPress sites running the ITERAS plugin version 1.8.2 or earlier. This can be done by checking the plugin's readme.txt or changelog exposed at /wp-content/plugins/iteras/readme.txt.
2. Obtain Contributor access: Register or compromise an account with at least Contributor-level privileges on the target WordPress site.
3. Create or edit a post/page: Navigate to the WordPress editor and insert one of the vulnerable shortcodes, e.g., [iteras-ordering] or [iteras-signup].
4. Inject malicious payload: Add a shortcode attribute containing a double-quote to break out of the JavaScript string context, followed by arbitrary JavaScript. For example: [iteras-ordering some-attr="", alert(document.cookie), "x"=""].
5. Publish the content: Save and publish the post or page containing the injected shortcode.
6. Trigger execution: When any user (including administrators) visits the page, the injected JavaScript executes in their browser, enabling session cookie theft, credential harvesting, or further attacks (GitHub Advisory, Wordfence).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing shortcode attributes with double-quote characters or JavaScript syntax (e.g., alert(, document.cookie, <script>).
• File System: Unexpected modifications to posts or pages in the WordPress database (wp_posts table) containing ITERAS shortcodes with unusual attribute values.
• Network: Outbound connections from victim browsers to attacker-controlled domains following page visits, potentially carrying stolen session tokens or credentials.
• Process/Application: Browser developer console errors or unexpected JavaScript execution on pages containing ITERAS shortcodes; unusual admin account activity following visits to affected pages (Wordfence).

Update the ITERAS plugin to version 1.8.3 or later, which addresses the insufficient escaping in the combine_attributes() function. As an interim measure, restrict Contributor-level access to only fully trusted users, and audit existing posts and pages for suspicious shortcode attributes or injected scripts. Site administrators should also consider temporarily disabling the affected shortcodes until patching is complete, and monitor for unauthorized content modifications (GitHub Advisory, Wordfence).

Wordfence identified and disclosed this vulnerability and included it in their weekly WordPress vulnerability report for April 20–26, 2026. No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been observed (Wordfence Weekly Report).