Security Alert Summary
The WP Allowed Hosts plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability in the handling of the allowed-hosts parameter. Authenticated attackers with administrator-level access or higher can inject scripts that execute when an affected page is viewed. This issue affects multi-site installations and installations where unfiltered_html has been disabled.
CVE Details
- CVE ID: CVE-2026-0734
- Affected plugin / component: WP Allowed Hosts plugin for WordPress
- Affected versions: All versions up to, and including, 1.0.8
- Published: January 14, 2026 7:16 AM UTC
- Last modified: January 14, 2026 4:25 PM UTC
- CVSS v3.1 base score: 4.4 (MEDIUM) —
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N - Authentication / privileges / user interaction: Authentication required; attacker privileges required: high (administrator-level access and above); user interaction: none
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- CWE / weakness ID: CWE-79 (Improper Neutralization of Input During Web Page Generation)
Technical Details
The vulnerability is a stored Cross-Site Scripting (XSS) issue arising from insufficient input sanitization and inadequate output escaping for the allowed-hosts parameter. When an attacker with administrative privileges supplies crafted input via this parameter, the plugin stores that input and later renders it into pages without proper escaping, allowing arbitrary web scripts to execute in the context of users who view the injected page.
The report indicates this behavior affects the plugin code that handles allowed hosts (see plugin file references included below). The issue only manifests in multi-site installations or when unfiltered_html is disabled, which changes which users’ input is filtered and how stored content is served.
Impact is limited to what a successful XSS can achieve in the affected context: disclosure of viewable data and manipulation of page content affecting integrity. There is no indication in the CVE entry of direct availability impact.
How This Could Impact Your Website
Consider a typical small organization running WordPress in a multi-site configuration. An administrator or an account with equivalent privileges could be induced or could intentionally save malicious input into the plugin’s allowed-hosts field. When other staff (editors, authors) or external contributors access the affected page, the injected script can execute in their browser. Practical consequences include limited disclosure of data visible to those users, manipulation of displayed content, and increased risk of targeted phishing or social engineering against staff whose email addresses or roles become known.
Because the vulnerability requires administrator-level privileges to exploit, the primary risk is from trusted accounts being compromised or misused. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and privileges, especially for administrator accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior, including unexpected changes to allowed hosts or stored content.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
