EUVD-2026-42173
GHSA-pj77-3rw8-fp35
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CSRF requires no attacker privileges (PR:N) but mandates admin interaction (UI:R); impact is limited to low-integrity frontend content injection with no confidentiality or availability effects.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Wp Js Detect plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.9. This is due to missing or incorrect nonce validation on the plugin_settings function. This makes it possible for unauthenticated attackers to update the plugin's notification text and CSS settings (wp_non_js_notification_text and wp_non_js_notification_css), injecting arbitrary content that is echoed unescaped on the frontend via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
AnalysisAI
Cross-Site Request Forgery in the Wp Js Detect WordPress plugin (all versions ≤ 1.0.9) permits unauthenticated attackers to overwrite the plugin's frontend notification text and CSS settings by exploiting absent nonce validation in the plugin_settings function. Because the stored values are echoed unescaped to the WordPress frontend, a successful forged request can inject arbitrary HTML or script content visible to site visitors who have JavaScript disabled. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists; EPSS data was not supplied.
Technical ContextAI
Wp Js Detect (vendor: wpkuf, CPE: cpe:2.3:a:wpkuf:wp_js_detect:*:*:*:*:*:*:*:*) is a WordPress plugin that detects visitor JavaScript support and renders a fallback notification for JS-disabled users. The root cause is CWE-352 (Cross-Site Request Forgery): the plugin_settings function, located in wp-js-detect.php at approximately lines 190-193 and 250 (per the Trac repository references), processes settings changes without verifying a WordPress nonce token. WordPress nonces are the platform-standard mechanism for confirming that a state-changing request originates from the authenticated user's own browser session; their absence allows any cross-origin forged request to succeed. A compounding issue is that the affected settings fields - wp_non_js_notification_text and wp_non_js_notification_css - are rendered on the frontend without output escaping, converting a settings-manipulation vulnerability into a persistent content-injection (and potentially stored XSS) vector.
RemediationAI
No vendor-released patched version is confirmed in the available data - the CPE range covers all versions through 1.0.9 without a fixed release referenced in any provided intelligence source. Administrators should immediately check the WordPress plugin repository for a Wp Js Detect update beyond version 1.0.9 and apply it if available, monitoring the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/afca7b14-f3bb-4612-b81c-bde120b380ba for patch confirmation. If no update is yet available, the most effective compensating control is deactivating or uninstalling the Wp Js Detect plugin entirely, which eliminates the attack surface with the only trade-off being loss of the JavaScript-detection notification feature. If the plugin must remain active, restricting WordPress admin dashboard access to trusted IP ranges reduces the window for CSRF exploitation by limiting the contexts in which an administrator can be tricked into triggering a forged request. Additionally, deploying a Content Security Policy (CSP) header that restricts inline scripts can limit the escalation impact of the unescaped output should injection succeed, though this does not prevent the CSRF itself.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today