CVE-2026-10092: Cincopa WordPress Plugin Stored XSS Vulnerability – Unauthenticated Attack

Technical summary

CVE-2026-10092 is a stored XSS vulnerability (CWE-79) in the Cincopa plugin that stems from insufficient input sanitization and output escaping of the [cincopa] shortcode when processed via the comment_text filter hook. Unauthenticated attackers can craft a malicious shortcode argument that passes through the filter without validation, becomes stored in the WordPress database as part of a comment, and then executes arbitrary JavaScript in the browsers of all users who view that comment. The vulnerability requires comment functionality to be enabled but does not require authentication, administrative privileges, or user interaction beyond normal site browsing.

Business impact

A successful exploit enables attackers to deface content, steal session cookies or authentication tokens, redirect users to malicious sites, harvest sensitive information from logged-in users, or distribute malware. Because the payload persists in comments, it continues to affect all visitors until the malicious comment is removed. For WordPress sites that rely on community comments or moderation workflows, this can erode user trust and expose the site owner to legal liability if visitor data is compromised.

Affected systems

WordPress installations with the Cincopa video and media plugin installed and enabled. Risk is highest on sites that allow unauthenticated comment posting. Version 1.163 and all earlier versions are vulnerable; the ground-truth data does not specify a patched version, so administrators should verify the latest available version directly from the WordPress plugin repository or Cincopa's advisory.

Exploitability

Exploitability is straightforward: the attack vector is network-based, requires no authentication, involves low complexity, and can impact users across different origins (the CVSS vector includes S:C for scope changed). An attacker need only post a comment containing a malicious [cincopa] shortcode argument to a post on any vulnerable site. No special tools, authentication, or user interaction is required beyond the standard act of posting a comment. The vulnerability is not currently tracked in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Immediately identify WordPress installations with the Cincopa plugin active. Check the plugin version and verify the latest patched version from the official WordPress plugin repository or Cincopa's security advisory. Update to the patched version as soon as it is available. Until patching is possible, consider disabling comments on posts where the Cincopa plugin is used, or restrict comment posting to authenticated users only. Scan existing comments for suspicious [cincopa] shortcodes containing unexpected or obfuscated attributes and remove them.

Patch guidance

Contact Cincopa or check the WordPress plugin repository for the patched version that addresses CVE-2026-10092. The vulnerability affects versions up to and including 1.163; verify against the vendor advisory for the exact version number that includes the fix. Apply the update immediately after validating compatibility with your WordPress version and other active plugins. Test comment functionality on a staging environment before deploying to production.

Detection guidance

Review comments in your WordPress database for instances of [cincopa] shortcodes, particularly those with unusual or unfamiliar attribute values. Use WordPress security scanning plugins (e.g., Wordfence, Sucuri) configured to detect malicious shortcode patterns and stored XSS payloads in comments. Monitor server access logs for GET requests containing encoded or obfuscated JavaScript following visits to pages with comments. Implement a Web Application Firewall (WAF) rule to alert on or block shortcode syntax in comment POST requests, and enable comment moderation to catch suspicious submissions before publication.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH CVSS score (7.2), low attack complexity, and broad scope impact across different origins. It requires no authentication and affects all site visitors, making it particularly dangerous for high-traffic or community-driven WordPress sites. The stored nature of the payload means the attack persists until manually cleaned, creating a prolonged exposure window.

Risk score, explained

The CVSS 3.1 score of 7.2 reflects a network-accessible vulnerability with no authentication or user interaction required, low attack complexity, and scope change (affecting resources beyond the vulnerable component). While confidentiality and integrity are impacted, availability is not compromised, preventing a critical rating. The score appropriately captures the serious risk posed by an unauthenticated stored XSS that can affect any visitor to the compromised site.

Frequently asked questions