CVE-2026-76558 in WP Import Export Lite Plugin
Summary
by MITRE • 09/16/2026
The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screens, allowing users with a role as low as contributor to perform Stored XSS attacks which will trigger in the browser of a high privileged user, such as an administrator, viewing that screen.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in WP Import Export Lite versions prior to 3.9.33 represents a critical security flaw rooted in improper output encoding within the plugin's administrative interface. This specific issue is classified under CWE-79, which denotes Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting (XSS). The core technical failure lies in the handling of custom field names that are retrieved from the WordPress database and subsequently rendered directly into the HTML Document Object Model without any sanitization or escaping mechanisms. By failing to neutralize special characters such as quotes, ampersands, or script tags within these field names, the application allows maliciously crafted input to persist in the system's data store and execute when that data is displayed.
The operational impact of this vulnerability is significant due to its stored nature and the privilege escalation vector it enables. Unlike reflected XSS attacks which require tricking a user into clicking a link, stored XSS persists on the server side, meaning the malicious payload remains active until manually removed from the database. The attack chain begins with an attacker who possesses low-level privileges, such as that of a contributor or subscriber, creating posts and inserting custom fields containing executable JavaScript code. When an administrator, who holds high-privilege access to manage site settings, plugins, and users, views the administration screen where these imports are processed or displayed, the browser executes the embedded script in the context of the admin session. This allows the attacker to hijack administrative sessions, steal cookies or authentication tokens, perform actions on behalf of the administrator, or deface the website interface.
From a threat modeling perspective aligned with the MITRE ATT&CK framework, this vulnerability facilitates several malicious techniques including Credential Access via Browser Session Hijacking (T1539) and potentially Command and Control if further exploitation steps are taken to establish persistence. The lack of input validation on custom field names creates an open channel for code injection that bypasses standard user role restrictions because the execution context is elevated by virtue of the viewer's privileges rather than the attacker's. This discrepancy between data entry permissions and output rendering security is a common architectural weakness in legacy WordPress plugins where developer assumptions about user intent lead to insufficient defensive coding practices.
To mitigate this vulnerability, immediate action must be taken to update the WP Import Export Lite plugin to version 3.9.33 or later, which addresses these encoding deficiencies by implementing proper escaping functions such as esc_html or wp_kses_post when rendering custom field data in the DOM. For organizations unable to patch immediately due to compatibility constraints, temporary mitigation strategies include restricting access to the affected administration screens through additional security plugins that enforce stricter role-based access control and monitoring for anomalous activity involving custom post metadata. Furthermore, implementing a Content Security Policy header can help mitigate the impact of any successful XSS attempts by restricting the sources from which scripts are allowed to execute, thereby reducing the effectiveness of injected payloads even if they manage to bypass other defenses.