Description

Unauthenticated Cross Site Scripting (XSS) in WPComplete <= 2.9.5.6 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-24T12:16:52.980Z",
  "pubdate": "2026-08-24T12:16:52.980Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability exists in the WPComplete plugin, specifically affecting versions 2.9.5.6 and prior. This security flaw allows remote, unauthenticated threat actors to inject malicious JavaScript payloads into web pages rendered by the application. The primary impact of this vulnerability includes the potential execution of arbitrary client-side scripts in the context of a victim's browser session, leading to session hijacking, credential theft, and unauthorized manipulation of the DOM. The affected system is any WordPress installation utilizing vulnerable iterations of the WPComplete plugin. The risk implications are severe as the attack vector requires no prior authentication or specialized privileges, lowering the barrier to entry for malicious actors. Exploitation typically requires an unsuspecting user to interact with a crafted URL or component containing the malicious payload, which is then processed and reflected or stored by the vulnerable software without proper sanitization or output encoding.",
  "technicalDetails": "The vulnerability resides in the input handling and output rendering mechanisms of the WPComplete plugin for WordPress. Specifically, versions 2.9.5.6 and earlier fail to adequately sanitize user-supplied input parameters or properly encode data before reflecting or outputting it within the Document Object Model (DOM).\nRoot Cause: Insufficient input sanitization and lack of contextual output encoding within the vulnerable component of WPComplete. When parameters are processed by the application, malicious HTML or JavaScript strings are accepted and subsequently rendered directly into the HTTP response.\nAttack Vector and Network Exposure: The vulnerability is exposed over the network via HTTP/HTTPS requests processed by the WordPress site. Because the flaw is unauthenticated, any remote attacker can interact with the vulnerable endpoint without possessing valid user credentials or elevated privileges.\nStep-by-Step Attack Flow:\n1. The attacker crafts a malicious URL or HTTP request containing a payload consisting of JavaScript code encapsulated within HTML tags (e.g., <script> tags or event handlers like onload or onerror).\n2. The attacker induces a target user to click the crafted link or visit the compromised endpoint, thereby transmitting the malicious payload to the server.\n3. The WPComplete plugin processes the incoming request and incorporates the unvalidated input into the generated web page response.\n4. The victim's browser receives the HTTP response, parses the injected script as legitimate content, and executes the arbitrary JavaScript within the security context of the victim's session.\nPayload Behavior and Post-Exploitation Impact: Upon successful execution, the injected script can access sensitive session cookies, perform actions on behalf of the authenticated user, manipulate the page content to display phishing interfaces, or redirect the user to malicious external sites. The lack of authentication requirements significantly broadens the threat landscape, allowing mass exploitation via automated scanning and social engineering campaigns."
}