Security Alert Summary
The Orange Confort+ accessibility toolbar for WordPress contains a stored cross-site scripting (XSS) vulnerability in the ocplus_button shortcode. An authenticated user with Contributor-level access or higher can inject scripts via the style parameter, which will execute when an affected page is viewed.
CVE Details
- CVE ID:
CVE-2026-1808 - Affected component: Orange Confort+ accessibility toolbar for WordPress plugin
- Affected versions: All versions up to, and including, 0.7
- Published: February 6, 2026 at 7:16:11 AM (UTC)
- Last modified: February 6, 2026 at 3:14:47 PM (UTC)
- CVSS v3.1: Base Score 6.4 — MEDIUM
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low (Contributor-level or higher)
- User Interaction: None
- Scope: Changed
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
- CWE / weakness: CWE-79 (Cross-site Scripting)
Technical Details
The plugin implements an ocplus_button shortcode that accepts a style parameter. According to the CVE description, input passed in that parameter is not sufficiently sanitized or escaped on output, allowing stored cross-site scripting. Because the payload is stored in page content, any user who views a page containing a malicious style value will execute the injected script in their browser context.
This is a stored XSS issue caused by insufficient input validation and missing output escaping for shortcode-provided data. The vulnerability exists in all plugin releases through version 0.7 as stated in the CVE entry.
How This Could Impact Your Website
In a typical site with multiple users, an individual with Contributor-level access (for example, an external content contractor or a lower-privilege internal staff member) could insert a malicious style value into a post or page via the ocplus_button shortcode. When other users—editors, administrators, or site visitors—view the page, the injected script can run in their browsers. Practical consequences may include unauthorized disclosure of sensitive information accessible to the browser (limited confidentiality impact), or unwanted modification of page content or user-visible data (limited integrity impact). Availability is not indicated as affected by this vulnerability.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. (The CVE entry does not specify a fixed version.)
- Review and reduce unnecessary user roles, especially contributors.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and content changes for unusual behavior or unexpected shortcode usage.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/orange-confort-plus/tags/0.7/inc/class-shortcode.php#L50
- https://plugins.trac.wordpress.org/browser/orange-confort-plus/trunk/inc/class-shortcode.php#L50
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3453313%40orange-confort-plus&new=3453313%40orange-confort-plus&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/89cb81c3-25d7-4a4e-beed-558ea8ce721d?source=cve
