What is the CVSS score of CVE-2026-13042?

CVE-2026-13042 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of RPB Chessboard are affected by CVE-2026-13042?

The RPB Chessboard WordPress plugin (versions ≤8.1.2) contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious JavaScript through post comments,…

How to fix or mitigate CVE-2026-13042?

Within 24 hours, disable WordPress comments site-wide or enable strict pre-publication comment moderation on all sites running RPB Chessboard plugin version 8.1.2 or earlier. Within 7 days, test migration to an alternative plugin and deploy a Web Application Firewall rule to restrict HTML tag insertions in comment submissions. Within 30 days, complete migration away from RPB Chessboard plugin version 8.1.2 or implement persistent WAF filtering combined with automated comment content monitoring.

RPB Chessboard CVE-2026-13042

EUVD-2026-44865 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-16 Wordfence

GHSA-23qv-c3w3-qc96

WordPress XSS Wordpress Plugin Rpb Chessboard

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

7.2 HIGH

Unauthenticated network comment submission (PR:N/AV:N/AC:L); stored XSS crosses into other users' browser context (S:C) with limited confidentiality/integrity and no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 16, 2026 - 04:46 vuln.today

CVE Published

Jul 16, 2026 - 03:44 cve.org

HIGH 7.2

DescriptionCVE.org

The RPB Chessboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 8.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress's save-time kses sanitization does not mitigate this issue because the crafted payload uses only kses-allowed tags and attributes (such as an <a> element with title and href), and the dangerous attribute-breaking HTML is synthesized entirely at render time by the plugin's own comment_text filter.

AnalysisAI

Stored cross-site scripting in the RPB Chessboard WordPress plugin (all versions through 8.1.2) lets unauthenticated attackers plant persistent JavaScript through comment content that executes in the browser of anyone who later views the affected page. The novel aspect, per Wordfence, is that WordPress's normal save-time kses sanitization is bypassed because the payload uses only kses-allowed tags/attributes (an <a> element with title and href) and the dangerous attribute-breaking markup is assembled entirely at render time by the plugin's own comment_text filter. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, no-interaction entry point makes it a practical drive-by injection risk.

Technical ContextAI

This is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) flaw, but with a render-time twist. WordPress hardens comment storage with kses, an allow-list HTML sanitizer that strips disallowed tags and attributes at save time. RPB Chessboard hooks WordPress's comment_text filter (see the AbstractController code around lines 171, 190 and 220 in the 8.1.0/8.1.2 tags) and re-processes stored comment text to render chess notation and diagrams. During that transformation it concatenates or reformats attribute values that were individually kses-safe (title, href on an anchor) into new HTML in a way that breaks out of the intended attribute context, synthesizing executable script markup that never existed in the stored, sanitized form. The affected product per CPE is cpe:2.3:a:yo35:rpb_chessboard (vendor yo35), across all wildcard versions up to 8.1.2.

RemediationAI

Update the RPB Chessboard plugin to the fixed release above 8.1.2 as soon as it is confirmed available; the WordPress plugin trac changeset (https://plugins.trac.wordpress.org/changeset?reponame=&old=3604068%40rpb-chessboard&new=3604068%40rpb-chessboard) shows the upstream code fix, but a specific tagged patched version is not independently confirmed from the provided data, so verify the target version against the plugin's changelog before deploying. Until then, effective compensating controls include disabling comments (or comment rendering) on any pages/posts that use RPB Chessboard shortcodes or blocks - this removes the injection sink but also removes commenting on those pages; requiring comment moderation/approval before publication so injected anchors are reviewed before they reach visitors - this adds moderator workload and depends on reviewers spotting crafted title/href values; and placing a WAF/virtual-patch rule (e.g. Wordfence) in front of comment submission to block anchor payloads carrying script-breaking title/href content. Reference the Wordfence advisory (link above) for detection signatures.