Security Alert Summary
The Tune Library plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability in its CSV import functionality that can be abused by authenticated users (Subscriber-level and above) to inject JavaScript into pages rendered by the [tune-library] shortcode. The issue is caused by missing authorization checks and insufficient input sanitization and output escaping of imported data.
CVE Details
- CVE ID: CVE-2026-1401
- Affected component: Tune Library plugin for WordPress
- Affected versions: All versions up to, and including, 1.6.3
- Published: February 6, 2026 at 07:16:11 AM UTC
- Last modified: February 6, 2026 at 03:14:47 PM UTC
- CVSS v3.1: Base Score 6.4 — MEDIUM; Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Authentication / privileges / user interaction: Requires authentication (attacker with Subscriber-level access or above). CVSS indicates Privileges Required: LOW; User Interaction: NONE.
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- Weakness (CWE): CWE-79 (Cross-site Scripting)
Technical Details
This vulnerability is a stored XSS in the CSV import path of the Tune Library plugin. The plugin’s CSV import functionality does not perform proper authorization checks and fails to sanitize or escape user-supplied attributes prior to storage. Imported data is later rendered without escaping through the [tune-library] shortcode, allowing an authenticated user to inject arbitrary script that will be stored and executed when a page containing the shortcode is viewed.
The root causes identified in the CVE are: missing authorization checks in the import flow and insufficient input sanitization/output escaping of imported fields. The CVE references the plugin’s import-related code and rendering hooks as the locations where unescaped data is persisted and output.
Impact is limited to what stored XSS typically enables in this context: execution of attacker-supplied JavaScript in the context of users who view the affected pages. The CVE data does not indicate remote code execution, administrative takeover, or availability impact.
How This Could Impact Your Website
Consider a multi-user WordPress site where the site owner manages plugin settings, internal staff publish content, and an external contractor or contributor imports data. An authenticated contributor (Subscriber-level or higher) could import a CSV containing malicious JavaScript in a field that is later output by the [tune-library] shortcode. When other users (editors, administrators, or regular visitors) view the page, the script could run in their browsers.
- Potential exposure of low-sensitivity data visible in the page or accessible via the browser (matching the CVSS confidentiality: Low).
- Ability to alter displayed content or perform actions within the viewer’s browser session (integrity: Low), which could be used to facilitate targeted phishing or social-engineering against staff or contractors.
- No indication in the CVE of site-wide availability loss or server compromise; the impact described is limited to client-side script execution when pages are viewed.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. (The CVE notes affected versions through 1.6.3; a fixed version is not specified in the CVE entry.)
- Review and reduce unnecessary user roles, especially contributors and any accounts with upload/import capabilities.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and limit CSV import capability to trusted accounts.
- Monitor site activity and logs for unusual behavior, including unexpected changes to pages rendered with the
[tune-library]shortcode.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/tune-library/tags/1.6.3/tune-library.php#L219
- https://plugins.trac.wordpress.org/browser/tune-library/tags/1.6.3/tune-library.php#L235
- https://plugins.trac.wordpress.org/browser/tune-library/tags/1.6.3/writeNodes.php#L113
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3451457%40tune-library&new=3451457%40tune-library&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/cd600810-b1bc-4025-b441-5c90da7240de?source=cve
