CVE-2026-89051 in Hide My WP Ghost Plugin
Summary
by MITRE • 10/16/2026
The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'replaceHeadersAndTags' function in versions up to, and including, 7.0.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user clicks on the injected link.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The WP Ghost plugin, also known as Hide My WP Ghost, is a widely utilized security solution designed to protect WordPress websites by masking their identity and providing firewall capabilities against various attacks. However, versions up through 7.0.12 contain a critical vulnerability classified under CWE-79, which pertains to Improper Neutralization of Input During Web Page Generation commonly known as Stored Cross-Site Scripting or Persistent XSS. This flaw resides specifically within the replaceHeadersAndTags function, where the application fails to adequately sanitize user-supplied input before storing it and subsequently fails to escape that data when rendering it in web pages for other users. The lack of proper validation allows malicious actors to inject arbitrary JavaScript code into the database via legitimate-looking requests, which are then served to victims without modification.
From an operational perspective, this vulnerability is particularly dangerous because it does not require authentication, allowing unauthenticated attackers to exploit the flaw remotely and anonymously. Once a victim clicks on a link containing the injected payload or visits a page where the malicious script has been stored, the JavaScript executes within the context of the vulnerable WordPress site. This execution environment grants the attacker significant leverage over the user's session, potentially leading to account takeover if administrative credentials are stolen via keyloggers or cookie theft. Furthermore, attackers can use this vector to deface websites, redirect users to malicious phishing sites, or deploy further malware onto visitor systems through drive-by downloads. The persistent nature of stored XSS means that every subsequent visit by any user to the affected page triggers the attack, amplifying the potential impact across a large user base without requiring repeated exploitation attempts.
In terms of threat modeling and industry standards, this vulnerability aligns with MITRE ATT&CK technique T1059, specifically sub-technique 007 for JavaScript execution, which describes how attackers use scripts to perform actions on behalf of users or systems. The attack chain typically involves initial access via the unauthenticated endpoint, followed by persistence through storage in the database, and finally impact through credential harvesting or session hijacking. Security professionals should note that this type of vulnerability often stems from a failure to implement defense-in-depth strategies such as Content Security Policy headers, which could mitigate some effects even if input sanitization is imperfect.
To remediate this issue, administrators must immediately update the WP Ghost plugin to version 7.0.13 or later, where these sanitization and escaping mechanisms have been corrected. For sites that cannot be updated instantly due to compatibility concerns with other plugins, temporary mitigations include implementing a Web Application Firewall rule set that detects and blocks payloads containing common XSS indicators such as script tags, event handlers like onerror or onload, and javascript: URIs in the specific parameters associated with the replaceHeadersAndTags function. Additionally, enabling strict Content Security Policy headers can help restrict the execution of inline scripts, thereby reducing the success rate of exploitation attempts until a permanent patch is applied. Regular auditing of plugin code for proper input validation practices remains essential to prevent similar vulnerabilities from being introduced in future updates or other plugins within the WordPress ecosystem.