Security Alert Summary
The Weaver Show Posts plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability via the add_class parameter in all versions up to and including 1.8.1. Insufficient input sanitization and output escaping of user-supplied attributes can allow authenticated attackers with Administrator-level access to inject scripts that execute when affected pages are viewed. The issue primarily affects multisite installations where Administrators do not have the unfiltered_html capability.
CVE Details
- CVE ID: CVE-2026-2121
- Affected component: Weaver Show Posts plugin for WordPress
- Affected versions: All versions up to and including 1.8.1
- Published: March 21, 2026 at 4:16:57 AM UTC
- Last modified: March 21, 2026 at 4:16:57 AM UTC
- CVSS v3.1: Base Score 4.4 (MEDIUM) — Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
- Authentication / Privileges / User Interaction: Attacker must be authenticated. Privileges required: High (Administrator-level). User interaction: None.
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- CWE: CWE-79 (Cross-site Scripting)
Technical Details
The vulnerability is a stored cross-site scripting (XSS) issue arising from insufficient input sanitization and insufficient output escaping of user-supplied attributes. Specifically, the add_class parameter can contain attacker-controlled input that is later rendered into pages without proper sanitization or escaping. When an authenticated attacker with Administrator-level privileges supplies crafted content via this parameter, arbitrary web scripts can be stored and will execute in the context of any user who views the affected page.
The vulnerability is especially relevant on multisite installations where Administrators do not have the unfiltered_html capability, as normal HTML filtering assumptions may not prevent the injected content from being saved and displayed. The attack does not require user interaction to trigger once the malicious content is stored; it executes when an affected page is accessed.
How This Could Impact Your Website
Consider a site with multiple users: a site owner, internal staff editors, and an external contractor who manages content. Because the vulnerability requires Administrator-level access to inject payloads, an attacker who already has an Administrator account could store a malicious script in the plugin’s attributes. When other users, including editors or site visitors, load the affected page, the script could run in their browsers. Practical consequences include exposure of data accessible in the browser (for example, session-related tokens), unauthorized actions performed in the context of an authenticated user, and an increased risk of targeted phishing or social engineering against staff whose email addresses or roles are discoverable.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and accounts with Administrator-level access.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce attack surface.
- Monitor site activity and logs for unusual behavior, including unexpected changes to content or widget attributes.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/show-posts/tags/1.8.1/includes/posts-widgets.php#L32
- https://plugins.trac.wordpress.org/browser/show-posts/tags/1.8.1/includes/posts-widgets.php#L45
- https://plugins.trac.wordpress.org/browser/show-posts/trunk/includes/posts-widgets.php#L32
- https://plugins.trac.wordpress.org/browser/show-posts/trunk/includes/posts-widgets.php#L45
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e0d525ab-a86d-4750-9d16-731cbc0a626e?source=cve
- https://youtu.be/kbSqUuEAyho
