Security Alert Summary
The List Site Contributors plugin for WordPress contains a reflected Cross-Site Scripting (XSS) vulnerability in the alpha parameter in versions up to and including 1.1.8. An unauthenticated attacker could craft a link that, if clicked by a user, causes arbitrary script execution in the victim’s browser due to insufficient input sanitization and output escaping.
CVE Details
- CVE ID: CVE-2026-0594
- Affected component: The List Site Contributors plugin for WordPress
- Affected versions: Versions up to and including 1.1.8
- Published: January 14, 2026 at 6:15:54 AM UTC
- Last modified: January 14, 2026 at 4:25:12 PM UTC
- CVSS v3.1: Base Score 6.1, Severity MEDIUM
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Attack Vector: Network (AV:N)
- Attack Complexity: Low (AC:L)
- Privileges Required: None (PR:N)
- User Interaction: Required (UI:R)
- Scope: Changed (S:C)
- Confidentiality Impact: Low (C:L)
- Integrity Impact: Low (I:L)
- Availability Impact: None (A:N)
- Authentication / Privileges: No authentication required; attacker can be unauthenticated.
- Primary impact: Limited confidentiality and integrity impact via execution of injected scripts in a user’s browser.
- CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting)
Technical Details
The vulnerability is a reflected Cross-Site Scripting (XSS) issue caused by insufficient input sanitization and output escaping for the alpha parameter. Because the plugin returns user-supplied data in page output without proper encoding, an attacker can craft a URL containing script payloads in the alpha parameter that are reflected back and executed in the context of a victim’s browser when they click the link.
This is a reflected XSS vector: the malicious input is not stored on the server but reflected in a response, and successful exploitation requires the victim to interact (for example, by clicking a crafted link). The CVE description attributes the root cause to missing or insufficient sanitization/escaping checks for that parameter.
How This Could Impact Your Website
In a typical small-business WordPress site, an attacker could send a crafted link to internal staff or external contributors. If a staff member or contributor clicks the link, the injected script could run in their browser and perform actions available to that user or read data visible to them. Possible practical consequences include disclosure of information visible to the clicked user (such as profile details or email addresses), or use of the session context to perform actions permitted to that user.
For example, an external contractor with contributor-level access who clicks a malicious link could have session-scoped data exposed to the attacker or be tricked into performing actions that change content or settings available to their role. While this CVE indicates limited confidentiality and integrity impact rather than site-wide takeover, it increases the risk of targeted phishing or social-engineering that could be leveraged against higher-privileged users.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Temporarily limit exposure by reducing publicly accessible locations where the vulnerable parameter might be used or linked until a fix is applied.
- Review and reduce unnecessary user roles and privileges, especially for contributors and other lower-trust roles.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior or unexpected requests that include suspicious query parameters.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/list-site-contributors/tags/1.1.8/list-site-contributors.php#L435
- https://plugins.trac.wordpress.org/browser/list-site-contributors/trunk/list-site-contributors.php#L435
- https://www.wordfence.com/threat-intel/vulnerabilities/id/026a2e0d-4d30-4133-9118-055026aa9f4a?source=cve
