EUVD-2026-38684
GHSA-4mxp-2cfv-x3f6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Stored XSS still requires victim page access (UI:R); author-level auth needed (PR:L); scope changes to victim browser (S:C); no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The WP Latest Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted image src attributes in post content in versions up to, and including, 5.0.11. This is due to insufficient output escaping in the field() and loop() functions, which extract the raw src attribute value from <img> tags within post_content using a regular expression and then reconstruct new <img> elements or CSS background-image declarations by directly concatenating the unescaped value - bypassing WordPress's kses filtering entirely. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in the WP Latest Posts WordPress plugin (versions up to and including 5.0.11) allows authenticated attackers with author-level access to plant persistent JavaScript payloads by crafting malicious image src attributes in post content. The plugin's field() and loop() functions in wplp-front.inc.php extract raw src values via regex and reconstruct HTML img elements or CSS background-image declarations through direct string concatenation, entirely bypassing WordPress's built-in kses sanitization. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the scope change to the victim's browser context enables session hijacking or credential theft against any user who visits an injected page.
Technical ContextAI
The affected component is the WP Latest Posts plugin for WordPress, developed by JoomUnited (CPE: cpe:2.3:a:joomunited:wp_latest_posts:*:*:*:*:*:*:*:*). The vulnerability exists specifically in /inc/wplp-front.inc.php, where the field() function (line ~2738) and loop() function (lines ~2284 and ~2326) process post_content by applying a regular expression to extract raw src attribute values from img tags, then reconstruct new img HTML elements or CSS background-image declarations via direct string concatenation without any output escaping. WordPress's kses filter - the platform's standard mechanism for stripping dangerous HTML attributes from stored content - is bypassed entirely because these functions operate on content after it has already passed through storage, re-parsing and re-emitting raw attribute values outside the kses pipeline. The root cause class is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a stored variant where the injection point is the image src attribute and the sink is the reconstructed HTML or CSS output rendered to site visitors.
RemediationAI
No confirmed patched version is identified in the available intelligence data - all provided references point exclusively to the 5.0.11 tag in the WordPress Trac repository, with no newer release confirmed as containing a fix. Site administrators should immediately check the WordPress.org plugin repository for a version of WP Latest Posts newer than 5.0.11 and apply any available update. If no update is available, deactivating or removing the WP Latest Posts plugin eliminates the attack surface entirely, at the cost of losing the plugin's post-display functionality. As a compensating control without deactivating the plugin, restrict author-level and above WordPress roles to fully trusted, verified users only - removing external contributors or unverified author accounts closes the primary attack vector. Avoid granting author or editor roles during the remediation window. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/e00f69d6-df33-4179-843b-98f8ed034e4a should be monitored for patch confirmation and updated guidance.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today