EUVD-2026-22865
GHSA-qq42-h26h-x735
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The WM JqMath plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style' shortcode attribute of the [jqmath] shortcode in all versions up to and including 1.3. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. The generate_jqMathFormula() function directly concatenates the 'style' attribute value into an HTML style attribute without applying esc_attr() or any other escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored cross-site scripting in WM JqMath WordPress plugin up to version 1.3 allows authenticated contributors and above to inject arbitrary JavaScript via the 'style' shortcode attribute, which executes in the browsers of all users viewing affected pages. The vulnerability stems from direct concatenation of unsanitized user input into HTML without proper escaping (missing esc_attr() calls). CVSS 6.4 reflects moderate risk with scope change; no public exploit code or active KEV status identified at time of analysis.
Technical ContextAI
WM JqMath is a WordPress plugin that renders mathematical formulas using the jqMath library. The vulnerability exists in the generate_jqMathFormula() function, which processes the [jqmath] shortcode. WordPress shortcode attributes are user-controlled when edited by authenticated users with Contributor role or higher. The plugin fails to apply WordPress's esc_attr() sanitization function before embedding the 'style' attribute value directly into HTML output. This is a classic Stored XSS (CWE-79: Improper Neutralization of Input During Web Page Generation) where the malicious payload persists in post/page content and executes every time the page loads. The affected CPE (cpe:2.3:a:webmindpt:wm_jqmath:*:*:*:*:*:*:*:*) covers all versions through 1.3.
RemediationAI
Disable or remove the WM JqMath plugin immediately if not required. If the plugin is essential, check for version 1.4 or later, which should include input sanitization fixes (e.g., application of esc_attr() to the 'style' attribute before output). Consult the plugin's changelog or the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/b4aebb45-b47b-4b5a-8281-400a4b786689) for the exact patched version. As an interim workaround, restrict Contributor-level access to users who are trusted, and audit existing posts/pages using [jqmath] shortcodes for suspicious style attribute values. Implement a Content Security Policy (CSP) header to mitigate inline script injection where possible, though this does not fully replace patching. Review and remove any suspicious shortcode content that may have been injected by less-trusted contributors.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today