Security Alert Summary
The Private Comment plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its “Label text” setting affecting all versions up to and including 0.0.4. Due to insufficient input sanitization and output escaping of the label text option, authenticated attackers with Administrator-level access can inject scripts that execute when an affected page is viewed. This vulnerability only affects multisite installations and installations where unfiltered_html has been disabled.
CVE Details
- CVE ID: CVE-2026-2281
- Affected plugin / component: The Private Comment plugin for WordPress (label text option)
- Affected versions: All versions up to, and including, 0.0.4
- Published: February 18, 2026 at 7:16:10 AM
- Last modified: February 18, 2026 at 7:16:10 AM
- CVSS v3.1: Base Score 4.4, Severity MEDIUM
- Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
- Authentication / Privileges / User Interaction: Authentication is required; the description states attackers must be authenticated with Administrator-level access or above. CVSS indicates Privileges Required: HIGH and User Interaction: NONE.
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- CWE / weakness ID: CWE-79 (Cross-site Scripting)
Technical Details
This issue is a stored Cross-Site Scripting (XSS) vulnerability rooted in insufficient input sanitization and output escaping for the plugin’s “Label text” option. When an attacker with the required administrative privileges saves a crafted value in that setting, the plugin stores the value without properly sanitizing or escaping it on output. As a result, the injected script will be served in pages that render the label text and will execute in the context of any authenticated user who loads an injected page.
The vulnerability is limited to environments described in the CVE: multisite installations and installations where unfiltered_html is disabled. No specific functions or REST endpoints are named beyond the plugin’s label text option in the provided description.
How This Could Impact Your Website
In a realistic scenario, a site owner or administrator uses the Private Comment plugin to configure comment labels. If an administrator account or another account with equivalent privileges is malicious or becomes compromised, the attacker could store a malicious script in the label text. When internal staff (for example, editors or other administrators) or external contractors view pages that render that label, the script can execute in their browsers. Practical consequences consistent with the reported impact include limited exposure of information (for example, disclosure of data accessible within a user session) and potential modification or injection of visible content on pages where the label appears, increasing the risk of targeted social engineering or phishing against staff.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. (The CVE notes affected versions through 0.0.4; if a fixed version is not specified in vendor advisories, treat the plugin as vulnerable until confirmed otherwise.)
- Review and reduce unnecessary user roles and high-privilege accounts, especially Administrator-level accounts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins, or replace them with actively maintained alternatives.
- Monitor site activity and logs for unusual behavior, such as unexpected changes to plugin settings or new content changes from administrative accounts.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/private-comment/tags/0.0.3/private-comment.php#L128
- https://plugins.trac.wordpress.org/browser/private-comment/trunk/private-comment.php#L128
- https://plugins.trac.wordpress.org/changeset/3458294/private-comment/trunk/private-comment.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/94d75f18-67ab-4367-982b-73e256d5dbe2?source=cve
