Security Alert Summary
The rexCrawler plugin for WordPress contains a reflected cross-site scripting (XSS) vulnerability in the search-pattern tester page. Unauthenticated attackers can inject script code via the url and regex parameters that may execute if an administrator is tricked into clicking a crafted link. This issue affects multi-site installations and sites where unfiltered_html has been disabled, in all versions up to and including 1.0.15.
CVE Details
- CVE ID:
CVE-2026-2277 - Affected component: rexCrawler plugin for WordPress (search-pattern tester page)
- Affected versions: All versions up to, and including, 1.0.15
- Published: March 21, 2026 at 4:16:57 AM UTC
- Last modified: March 21, 2026 at 4:16:57 AM UTC
- CVSS v3.1: Base Score 6.1, Severity MEDIUM
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Vector:
- Authentication required: No
- Privileges required: None
- User interaction: Required
- Scope: Changed
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation)
Technical Details
The vulnerability is a reflected cross-site scripting issue caused by insufficient input sanitization and output escaping on the plugin’s search-pattern tester page. Specifically, user-supplied values passed in the url and regex parameters are not properly sanitized or escaped before being reflected back to the page. The problem is present in the plugin code for the tester page (see admin_regex_test.php in the plugin references).
Because the input is reflected and not validated, an attacker can craft a URL that includes JavaScript payloads in those parameters. If an administrator or another user with sufficient privileges on a multi-site installation (or on sites where unfiltered_html is disabled) clicks the malicious link, the injected script can execute in the administrator’s browser context. The impact is limited to the confidentiality and integrity of data accessible in that browser session and does not indicate direct impact to server availability.
How This Could Impact Your Website
In a realistic scenario, an attacker creates a specially crafted link containing payloads in the url or regex parameters and distributes it to site staff or contractors. If a site administrator on a multisite installation or a site where unfiltered_html is disabled clicks that link, the injected script can run in their browser. This could lead to disclosure of information visible to the administrator (for example admin-visible email addresses), modification of content displayed in the admin interface, or other actions that rely on the administrator’s browser context. Such exposures increase the risk of targeted phishing or social engineering against staff or contractors.
professional review If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and accounts with administrative capabilities.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your installation.
- Monitor site activity and admin account behavior for unusual or unexpected actions.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/rexcrawler/tags/1.0.15/admin_regex_test.php#L25
- https://plugins.trac.wordpress.org/browser/rexcrawler/tags/1.0.15/admin_regex_test.php#L29
- https://plugins.trac.wordpress.org/browser/rexcrawler/trunk/admin_regex_test.php#L25
- https://plugins.trac.wordpress.org/browser/rexcrawler/trunk/admin_regex_test.php#L29
- https://www.wordfence.com/threat-intel/vulnerabilities/id/2a17f466-bc4b-4668-8ff9-e8b316e3b5b7?source=cve
