CVE-2026-1827 in Flask Micro code-editor Plugin
Summary
by MITRE • 02/11/2026
The Flask Micro code-editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's codeflask shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 02/12/2026
The Flask Micro code-editor plugin for WordPress represents a significant security vulnerability classified as CVE-2026-1827, which affects all versions up to and including 1.0.0. This vulnerability manifests as a stored cross-site scripting flaw that specifically targets the plugin's codeflask shortcode functionality, making it particularly dangerous for WordPress environments where the plugin is actively used. The issue stems from inadequate input sanitization and output escaping mechanisms that fail to properly validate or escape user-supplied attributes before they are processed and stored within the WordPress database. Attackers exploiting this vulnerability can persistently inject malicious scripts that will execute whenever any user accesses pages containing the compromised shortcode, creating a persistent threat vector that can affect multiple users over time.
The technical exploitation of this vulnerability occurs through the manipulation of shortcode attributes within the codeflask shortcode implementation, where user-provided input is directly incorporated into the plugin's output without proper sanitization. This flaw falls under the CWE-79 category of Cross-Site Scripting, specifically representing a stored XSS variant where the malicious payload is stored server-side rather than being reflected in a single request. The vulnerability's impact is amplified by the fact that it requires only contributor-level access or higher, making it accessible to users who already possess significant privileges within the WordPress environment. This access level typically includes users who can create and edit posts, pages, and other content, meaning that an attacker with these credentials can inject malicious scripts that will execute in the context of other users' browsers, potentially leading to session hijacking, data theft, or further compromise of the WordPress installation.
The operational impact of CVE-2026-1827 extends beyond simple script execution, as it creates a persistent threat that can be leveraged for advanced attacks within the WordPress ecosystem. When authenticated attackers with contributor-level access inject malicious scripts through the compromised shortcode, these scripts execute whenever any user accesses pages containing the injected content, potentially affecting administrators, editors, and other privileged users who may not be aware of the compromised content. The stored nature of this vulnerability means that the malicious code remains active until manually removed from the database, providing attackers with extended persistence within the target environment. This vulnerability also aligns with ATT&CK technique T1566.001 for credential harvesting and T1059.001 for command and scripting interpreter, as attackers can use the stored XSS to establish footholds for further exploitation, potentially leading to complete compromise of the WordPress installation and underlying infrastructure.
Organizations affected by this vulnerability should implement immediate mitigations including disabling or uninstalling the vulnerable Flask Micro code-editor plugin until a patched version is available, implementing strict input validation for all shortcode attributes, and conducting comprehensive security audits of content created through the plugin. The recommended approach involves applying the principle of least privilege by limiting contributor-level access to only those users who absolutely require it, while also implementing content security policies that can help mitigate the impact of successful XSS attacks. Additionally, administrators should monitor for suspicious content creation patterns and implement proper output escaping mechanisms for all user-supplied content that is rendered in web pages, particularly focusing on shortcode implementations and other dynamic content generation features within WordPress plugins. The vulnerability serves as a reminder of the critical importance of input validation and output escaping in web applications, particularly in content management systems where user-generated content can be directly rendered in browser contexts without proper sanitization.