Security Alert Summary
The 12 Step Meeting List WordPress plugin contains a stored cross-site scripting (XSS) vulnerability that allows values submitted by unauthenticated users to be stored in the plugin activity log and rendered in an admin-area page without proper sanitisation or escaping. This can lead to script execution in the context of high-privilege users such as administrators when they view the affected admin page.
CVE Details
- CVE ID: CVE-2026-78333
- Affected component: 12 Step Meeting List WordPress plugin
- Affected versions: Versions before 3.19.17 (example reported: 3.17 is affected)
- Published: August 27, 2026 at 6:17:29 AM UTC
- Last modified: August 27, 2026 at 6:17:29 AM UTC
- CVSS v3.1: Not provided
- Authentication requirements: Not required for submission; unauthenticated users can submit the value that is stored
- Privileges required: None to submit the malicious value; the attack relies on a high-privilege user (for example, an administrator) viewing the affected admin page
- User interaction: An administrator or other high-privilege user must view the admin-area page where the activity log entry is rendered
- Primary impact:
- Confidentiality: Potential disclosure of sensitive information accessible to an admin user (for example, session tokens or data rendered in the admin context)
- Integrity: Potential for actions to be performed in the context of an admin user if script execution leads to forged requests
- Availability: Not indicated by the provided data; availability impact is not specified
- CWE / weakness ID: Not provided
Technical Details
According to the advisory text, the plugin does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin-area page. Because the stored value is later rendered in an admin page without proper sanitisation or encoding, an attacker can submit a payload that is stored on the site and later executed in the browser of a high-privilege user viewing that admin page. The issue is described as a Stored Cross-Site Scripting vulnerability and specifically involves the plugin’s activity log storage and output flow.
No specific function names, REST API endpoints, or code paths are listed in the provided data. The essential cause is missing sanitisation and escaping of user-supplied data before persisting and rendering it in an admin context.
Impact is limited to the capabilities of a stored XSS in an administrative context: script execution in the admin user’s browser which can be used to access data available to that user or to initiate requests that the admin user is permitted to make. The advisory explicitly notes the risk to high-privilege users such as administrators.
How This Could Impact Your Website
Consider a site with multiple roles: a site owner, internal editors or staff, and an external contractor or contributor who submits meeting information. An external contributor could submit a crafted value to the plugin’s public input that is stored in the activity log. When an admin later logs in to review activity or manage meetings and views the affected admin page, the stored script could execute in the admin’s browser.
Practical consequences include exposure of information accessible to the admin account, the possibility of actions being taken in the context of that admin session, and increased risk of targeted phishing or social engineering if internal email addresses or other identifiers are exposed through the admin interface. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level and lower-privileged accounts that can submit content.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins that increase your attack surface.
- Monitor site activity and admin logs for unusual behavior, including unfamiliar activity log entries.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
