Description

Unauthenticated Cross Site Scripting (XSS) in Estatik <= 4.3.4 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-02T12:17:13.530Z",
  "pubdate": "2026-09-02T12:17:13.530Z",
  "executiveSummary": "The Estatik plugin for WordPress, in versions 4.3.4 and earlier, is susceptible to an Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability. This security flaw allows remote, unauthenticated attackers to inject arbitrary malicious scripts into the web pages viewed by other users, including administrators.\nThe vulnerability arises due to the application's failure to properly sanitize or validate user-supplied input before reflecting it back to the client browser. Successful exploitation permits the execution of unauthorized JavaScript in the context of the victim's session, leading to potential account takeover, session hijacking, information theft, and unauthorized actions performed on behalf of the victim.\nGiven that the vulnerability does not require authentication, it presents a significant risk to the security integrity of affected WordPress installations. Attackers can leverage this flaw to target both administrative and non-administrative users. Immediate remediation is required to mitigate the risk of cross-site request forgery and data exfiltration through injected payloads.",
  "technicalDetails": "The vulnerability exists within the input handling mechanism of the Estatik plugin versions 4.3.4 and below. It is classified as a Reflected XSS (CWE-79), where the application processes data from an HTTP request and embeds that data into the immediate HTTP response without appropriate encoding or validation.\nThe root cause is the insufficient neutralization of malicious script tags and event handlers within user-controlled input parameters processed by the plugin's frontend components. Because the plugin does not implement strict context-aware output encoding (such as converting special characters into HTML entities), an attacker can craft a URL containing a script payload, such as '<script>alert(document.cookie)</script>', within an affected parameter.\nThe attack flow begins when an unauthenticated attacker identifies a public-facing parameter processed by the Estatik plugin. The attacker then crafts a malicious URL containing the XSS payload. When a victim—ideally an authenticated user with higher privileges—clicks the link or is otherwise induced to visit the crafted URL, the server reflects the malicious payload back into the HTML document generated for the user's session.\nUpon rendering, the victim's browser interprets the injected payload as legitimate application code and executes the script within the origin of the vulnerable site. This bypasses same-origin policy restrictions, allowing the attacker to access sensitive information such as session cookies, CSRF tokens, or personal user data.\nPost-exploitation, the attacker may perform unauthorized actions on behalf of the victim, such as modifying plugin configurations, injecting persistent backdoors, creating new administrative users, or exfiltrating sensitive database records. Since the vulnerability is unauthenticated and resides on the network-accessible interface, the attack surface is global, requiring no prior system knowledge or access credentials. The impact is elevated if the victim is an administrator, as the injected script inherits the administrative session context, potentially leading to full site compromise."
}