EUVD-2026-41490
GHSA-4689-rgvq-62r3
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Stored XSS requires a victim to visit the injected page (UI:R); subscriber-level account to plant payload (PR:L); scope change reflects browser context escape (S:C).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The JSON API User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter of the post_comment API endpoint in versions up to, and including, 4.1.0 This is due to insufficient input sanitization in the post_comment() function, which passes the attacker-controlled comment_content value directly to wp_insert_comment() without applying any HTML sanitization, and additionally allows the caller to set comment_approved=1 to self-approve the comment and bypass moderation. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in the JSON API User WordPress plugin (versions ≤ 4.1.0) allows authenticated attackers with subscriber-level or higher access to inject persistent JavaScript via the content parameter of the post_comment API endpoint. The plugin's post_comment() function passes attacker-controlled comment_content directly to WordPress's native wp_insert_comment() without any HTML sanitization, and a compounding design flaw permits callers to supply comment_approved=1 to self-approve comments and entirely bypass the WordPress moderation queue. No public exploit code or CISA KEV listing is confirmed at time of analysis; however, the CVSS scope-change flag (S:C) and low authentication barrier make this a meaningful risk on any site permitting open user registration.
Technical ContextAI
The JSON API User plugin (vendor: parorrey, CPE: cpe:2.3:a:parorrey:json_api_user:*:*:*:*:*:*:*:*) extends WordPress with REST-like API endpoints for user management and content interaction. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation) and is localized to the post_comment() function within controllers/User.php (publicly browsable at lines 979, 995, and 1007 in the 4.1.0 tag). The function accepts the caller-supplied content parameter and channels it as comment_content into WordPress's wp_insert_comment() without invoking standard sanitization routines such as wp_filter_comment() or kses-based HTML filtering. A second independent flaw in the same function accepts and honors a caller-supplied comment_approved=1 parameter, granting low-privileged API callers the ability to bypass the site's comment moderation queue - a capability normally reserved for editors and administrators. Together, these two weaknesses allow a subscriber-level account to persistently store executable script payloads that fire in any site visitor's browser on page load.
RemediationAI
Update the JSON API User plugin to version 4.1.2 or later, which addresses the missing sanitization in post_comment() and the unauthorized comment_approved self-approval, as evidenced by the Trac changeset at https://plugins.trac.wordpress.org/changeset?old_path=%2Fjson-api-user/tags/4.1.0&new_path=%2Fjson-api-user/tags/4.1.2. If immediate patching is not feasible, disabling the JSON API User plugin entirely removes the vulnerable endpoint with no impact on core WordPress functionality - this is the recommended interim control. As a secondary compensating measure, disabling open user registration (WordPress Admin → Settings → General → uncheck 'Anyone can register') prevents unauthenticated threat actors from self-provisioning the subscriber accounts needed to exploit this vulnerability; note this does not protect against pre-existing untrusted subscriber accounts. A WAF rule blocking <script> or event-handler injection in API comment payloads can provide additional depth-in-defense, though WAF bypasses are common for XSS and this should not be treated as a primary control.
More in Json Api User
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today