CVE-2026-77820 in WPComplete Plugin
Summary
by MITRE • 09/19/2026
The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and including, 2.9.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the premium version of the software in order to exploit. Please note this only affects the pro version.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/19/2026
The WPComplete plugin for WordPress contains a critical security vulnerability identified as Stored Cross-Site Scripting, specifically affecting versions up through 2.9.9.0. This flaw arises from insufficient input sanitization and output escaping mechanisms within the software's handling of shortcode attributes. The specific vector involves an empty attribute value that fails to be properly validated before being processed by the application logic. Because the vulnerability is classified as stored, malicious scripts are persistently saved on the target server rather than being executed solely through a single request. This persistence ensures that every time a user accesses a page containing the compromised shortcode, the injected script executes in their browser context, leading to persistent compromise of any visitor who views the affected content.
The technical nature of this flaw centers on the failure to escape special characters when rendering shortcodes with empty attributes. In WordPress environments, shortcodes are powerful tools that allow developers and users to embed dynamic functionality into posts or pages. When the WPComplete plugin processes these shortcodes, it does not adequately sanitize the input data associated with them. Consequently, an attacker can inject JavaScript code by manipulating the shortcode syntax. The vulnerability is particularly dangerous because it allows for the execution of arbitrary web scripts in the context of other users. This means that if a victim visits a page where the malicious payload has been stored, their browser will execute the script as if it originated from the trusted WordPress site, bypassing same-origin policy protections and potentially allowing session hijacking, credential theft, or defacement.
The operational impact of this vulnerability is significant for organizations relying on the WPComplete plugin to manage content or user interactions. Since the attack requires authenticated access with contributor-level privileges or higher, it represents an insider threat scenario where a compromised account can be leveraged to spread malware across the site. The requirement that only the premium version of the software is affected narrows the scope but does not diminish the severity for those users. Attackers who gain low-privileged access through phishing, credential stuffing, or other means can escalate their impact by injecting persistent scripts. This leads to potential data exfiltration from authenticated sessions, redirection of users to malicious sites, and erosion of trust in the website's integrity. The persistence of the attack vector means that remediation requires not only patching the software but also auditing existing content for injected payloads.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation known as Cross-site Scripting. It is further categorized under CWE-834 regarding Excessive Iterative Reliance on External Data when the system assumes input validity without verification. In terms of offensive security frameworks, this attack vector corresponds to MITRE ATT&CK technique T1059, specifically sub-technique 007 for Command and Scripting Interpreter: JavaScript. The stored nature of the XSS also relates to persistence mechanisms where attackers maintain access by embedding malicious code directly into content repositories rather than relying on transient query parameters or headers.
Mitigation strategies must address both immediate remediation and long-term security posture improvements. Administrators running WPComplete versions up to 2.9.9.0 should immediately update the plugin to a patched version that implements proper input sanitization using WordPress functions such as wp_kses_post for content validation and esc_attr or esc_html for output escaping depending on the context of use. It is crucial to audit all posts, pages, and custom post types created by users with contributor-level access or higher to identify any existing injected scripts. Security plugins that offer firewall capabilities can help detect and block attempts to exploit this vulnerability in real-time. Furthermore, implementing strict role-based access control policies ensures that only trusted administrators have the ability to create content containing shortcodes, reducing the attack surface for lower-privileged users who might otherwise be coerced or compromised into injecting malicious code. Regular security audits and penetration testing should also be conducted to identify similar input handling flaws in other plugins used within the WordPress ecosystem.