CVE-2026-7662: ePaperFlip Publisher WordPress Plugin Stored XSS Vulnerability

Technical summary

CVE-2026-7662 is a stored XSS flaw in the ePaperFlip Publisher WordPress plugin affecting versions up to 1.x. The vulnerability exists in the `epaperflip_embed` shortcode handler, specifically the 'publicationid' attribute parameter. The plugin insufficiently sanitizes this attribute and directly concatenates it into inline JavaScript without proper escaping, creating a code injection point. An authenticated attacker with Contributor or Editor privileges can craft a malicious shortcode containing JavaScript payload, store it in a post or page, and the payload executes in the browsers of any user viewing that content. This is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Business impact

Compromise of site visitor accounts and data is the primary risk. Attackers with Contributor access can inject keyloggers, credential-stealing scripts, or redirect users to phishing sites, affecting site reputation and user trust. For multi-author or agency WordPress installations where Contributor accounts are distributed, this creates a meaningful lateral movement and persistence vector. The attack surface extends to all pages containing the vulnerable shortcode, multiplying potential victim exposure.

Affected systems

ePaperFlip Publisher plugin for WordPress, all versions up to and including 1. The vulnerability requires an authenticated attacker with at minimum Contributor-level role, which is a standard WordPress role granted to authors and above. Any WordPress site running this plugin with contributors or higher-privilege users is in scope.

Exploitability

Exploitability is moderate in a layered sense. An attacker must first obtain Contributor or Editor credentials, either through compromise or by being a legitimate site contributor. No network interaction or user action beyond page viewing is required for payload execution—the script fires automatically when the page loads. However, the authentication requirement prevents mass remote exploitation of unrelated sites. Internal threats and compromised contributor accounts present the most realistic attack vector.

Remediation

Update the ePaperFlip Publisher plugin to a patched version as soon as available from the plugin repository. Until a patch is released, restrict Contributor-level access to only trusted users, disable the plugin if not actively in use, or remove any existing posts or pages using the `epaperflip_embed` shortcode. Review user roles and audit recent edits to pages containing the shortcode for signs of malicious modification.

Patch guidance

Monitor the official WordPress plugin repository and the ePaperFlip Publisher vendor website for a security update addressing this vulnerability. When available, update immediately through the WordPress dashboard Plugins > Updates interface. Before updating, back up your site. After patching, verify that all shortcodes render correctly and audit pages for any existing malicious payloads that may have been injected prior to the update. Consider scanning post and page content for suspicious JavaScript patterns if you suspect exploitation occurred.

Detection guidance

Inspect WordPress posts and pages for `epaperflip_embed` shortcodes with suspicious or unusual 'publicationid' parameter values, especially those containing script tags, event handlers, or obfuscated code. Review the WordPress revision history and user edit logs for any unexpected changes to pages containing these shortcodes. Monitor browser console warnings for failed or suspicious script loads on pages using the plugin. Use WordPress security plugins with shortcode scanning capabilities to flag potentially malicious attributes automatically.

Why prioritize this

Although this is a MEDIUM-severity vulnerability (CVSS 6.4), prioritization depends on your contributor user base. Organizations with minimal Contributor accounts or tight access controls should address this in standard maintenance windows. Agencies, multi-author publishers, or sites with large contributor communities should treat this more urgently, as the attack surface is wider and the barrier to exploitation lower. The stored nature of the XSS means the damage persists until remediated, affecting repeat visitors indefinitely.

Risk score, explained

CVSS 6.4 reflects moderate risk: the vulnerability requires authenticated access (reducing likelihood of mass exploitation), affects confidentiality and integrity of user sessions (not availability), and has a network-based attack vector with low complexity once credentials are obtained. The 'S:C' (Scope Changed) component elevates the score because the payload impacts users beyond the attacker's immediate scope. It is not critical, but material enough to warrant prompt patching in most organizations.

Frequently asked questions