Security Alert Summary
The FuseDesk plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability affecting the plugin’s fusedesk_newcase shortcode in all versions up to and including 6.8. Insufficient input sanitization and output escaping on the emailtext attribute allows authenticated users with Contributor-level access or higher to inject scripts that execute when an injected page is viewed.
CVE Details
- CVE ID: CVE-2026-1914
- Affected component: FuseDesk plugin for WordPress (fusedesk_newcase shortcode)
- Affected versions: All versions up to, and including, 6.8
- Published: March 21, 2026 at 4:16:56 AM
- Last modified: March 21, 2026 at 4:16:56 AM
- CVSS v3.1: Base score 6.4, Severity MEDIUM, Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Authentication / Privileges / User interaction: Authenticated attacker required — Contributor-level access or higher; Privileges required: LOW; User interaction: NONE
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation)
Technical Details
The vulnerability is a stored cross-site scripting (XSS) issue caused by insufficient input sanitization and output escaping on the emailtext attribute of the fusedesk_newcase shortcode. An authenticated user with Contributor-level access or higher can place a malicious payload into the emailtext attribute. Because the plugin does not properly sanitize or escape this input before rendering it on pages, the injected script is stored and will execute in the browser of any user who views the page containing the shortcode.
This behavior allows arbitrary web scripts to run in the context of the affected site when an injected page is accessed. The impact, as reflected in the CVSS data, is limited to confidentiality and integrity (both low) and does not indicate any direct availability impact.
How This Could Impact Your Website
Consider a site where a contractor or contributor can create content using the fusedesk_newcase shortcode. If an attacker with Contributor access injects a script into the emailtext attribute, that script will run when other users view the page. For example, internal staff or site editors who view the page could unknowingly expose profile information or other data accessible in their browser session. This increases the risk of targeted phishing or social engineering against staff and external collaborators by exposing email addresses or other visible information.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially Contributor and similar content roles.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and access logs for unusual behavior, especially after content changes.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
