EUVD-2026-14155
GHSA-58r6-ffpc-qpg6
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Mandatory Field plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.6.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
AnalysisAI
The Mandatory Field plugin for WordPress versions up to 1.6.8 contains a Stored Cross-Site Scripting (XSS) vulnerability in its admin settings due to insufficient input sanitization and output escaping. Authenticated administrators can inject arbitrary JavaScript that executes for all users accessing affected pages, but exploitation is limited to multi-site WordPress installations or those with unfiltered_html disabled. With a CVSS score of 4.4 and high attack complexity, this represents a moderate-severity privilege escalation risk for WordPress administrators seeking to inject malicious scripts; no public POC or active exploitation has been indicated in KEV data.
Technical ContextAI
This vulnerability is a Stored XSS flaw (CWE-79) in the Mandatory Field WordPress plugin (CPE: cpe:2.3:a:ketanmujumdar:mandatory_field:*:*:*:*:*:*:*:*), affecting all versions through 1.6.8. The root cause lies in the admin settings handler (identified in mandatory-plugin-option-page.php at line 14) which fails to properly sanitize user input before storing it in the database and fails to escape output when rendering saved settings. WordPress's sanitize_text_field() or wp_kses_post() functions should have been applied to $_POST data, and esc_attr() or esc_html() should have been applied during output. The vulnerability is scoped to multi-site WordPress installations or single-site installations where the unfiltered_html capability has been explicitly disabled, narrowing the attack surface compared to standard WordPress configurations where administrators typically retain unfiltered HTML privileges.
RemediationAI
Upgrade the Mandatory Field plugin to a version newer than 1.6.8 if a patched version has been released; check the WordPress plugin repository at https://wordpress.org/plugins/mandatory-fields/ for the latest version and update through the WordPress admin dashboard. Until a patch is available, restrict administrator account access to trusted personnel only, audit recent admin settings changes for injected script content, and monitor page source output for unexpected script tags in plugin-controlled settings fields. For multi-site installations, consider enforcing Content Security Policy (CSP) headers via HTTP headers to prevent inline script execution as a defense-in-depth measure. If the plugin is no longer maintained, consider switching to an actively maintained alternative for mandatory field functionality.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today