CVE-2026-9620: WP Latest Posts Stored XSS Vulnerability (v5.0.11)

Technical summary

The vulnerability stems from insufficient output escaping in the field() and loop() functions of WP Latest Posts. These functions extract src attribute values from <img> tags using regular expressions, then reconstruct image elements or CSS background-image declarations by directly concatenating the unescaped values. This approach bypasses WordPress's kses sanitization layer entirely. An authenticated attacker with author-level access can inject arbitrary JavaScript that will execute in the context of any page displaying the affected post. The CWE classification (CWE-79: Improper Neutralization of Input During Web Page Generation) confirms the root cause as insufficient input validation and output encoding.

Business impact

This vulnerability allows attackers with author-level access to compromise the integrity and confidentiality of your WordPress site. Injected scripts can steal user session tokens, modify page content, capture form submissions, or redirect visitors to malicious sites. For multi-author sites, a compromised author account becomes a vector for sitewide XSS attacks. Customer trust, regulatory compliance (especially for sites handling sensitive data), and SEO reputation are all at risk if injected content is discovered by users or security scanners.

Affected systems

WP Latest Posts plugin versions up to and including 5.0.11 are affected. The vulnerability requires the attacker to have at least author-level credentials (author, editor, or administrator role). Sites using older versions of the plugin are immediately at risk; verify your installed version against the plugin repository or your site's plugin management interface.

Exploitability

Exploitation requires pre-existing authenticated access at the author level or above. No unauthenticated attack vector exists. However, author-level accounts are relatively common in multi-user WordPress environments, particularly on publishing or team collaboration sites. The attack is straightforward: craft a post with an <img> tag containing a malicious src attribute, publish it, and the payload executes whenever the post is viewed. No user interaction beyond normal page viewing is needed for the XSS to trigger (UI:N in the CVSS vector).

Remediation

Update the WP Latest Posts plugin to a patched version released after 5.0.11. Verify against the official WordPress plugin repository or the vendor's security advisory for the exact version number. If an update is unavailable, disable or remove the plugin until a fix is confirmed. Additionally, audit posts created by author-level users for suspicious or unusual image src attributes that may indicate prior exploitation. Review author account access logs to identify compromise.

Patch guidance

Visit the WordPress plugin dashboard and check for available updates to WP Latest Posts. Apply the update as soon as testing confirms compatibility with your WordPress version and active theme/plugins. If you are using a custom or third-party hosting service, some platforms provide automated plugin updates; verify that auto-updates are enabled or manually trigger the update. Always back up your database and site files before applying updates. Test the update in a staging environment first if this is a production site with critical functionality.

Detection guidance

Search post_content in your WordPress database for <img> tags containing unusual or suspicious src attributes—particularly those with encoded JavaScript (javascript: protocol, event handlers encoded as entities, or Base64 payloads). Use WordPress security plugins (e.g., Wordfence, Sucuri, iThemes Security) to scan for stored XSS patterns in post metadata and content. Monitor your web server logs for requests to pages known to contain WP Latest Posts shortcodes or template calls, and inspect the HTML response for unexpected script tags. Check the WP Latest Posts plugin code in your /wp-content/plugins/ directory for calls to field() or loop() functions; verify they are properly escaping output using WordPress functions like esc_attr() or esc_url().

Why prioritize this

Although the CVSS score of 6.4 (MEDIUM) reflects the authentication requirement, the vulnerability is stored XSS affecting all site visitors and should be prioritized. The attack is trivial to execute for any compromised or malicious author, the impact on site visitors is high (arbitrary script execution), and the persistence in the database means cleanup is necessary even after patching. This is especially critical for publishing platforms, community sites, and any installation where you do not fully trust all author-level users.

Risk score, explained

The CVSS 3.1 score of 6.4 (MEDIUM) reflects: Attack Vector Network (remote exploitation possible), Access Complexity Low (straightforward payload injection), Privileges Required (author level needed, limiting the attacker pool), User Interaction None (no end-user action required for XSS to execute), and Scope Changed (impact extends beyond the vulnerable component to other users' browsers). Integrity and Confidentiality are impacted (I:L, C:L), but Availability is not (A:N). The score appropriately penalizes the authentication requirement but does not fully capture the reputational and compliance risks of stored XSS on a public-facing website.

Frequently asked questions