CVE-2026-92967 in Pochipp Plugin
Summary
by MITRE • 09/19/2026
The Pochipp plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'keyword' parameter in versions up to, and including, 1.20.2. This is due to insufficient output escaping , which reads $_GET['keyword'], applies only sanitize_text_field() (which strips tags but leaves double quotes intact) and interpolates the value directly into the value attribute of the search input via a PHP heredoc, without esc_attr(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user with upload_files capability (Author or above) into performing an action such as clicking on a specially crafted link to /wp-admin/media-upload.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/19/2026
The vulnerability identified within the Pochipp plugin for WordPress, specifically affecting versions up through 1.20.2, represents a classic instance of Reflected Cross-Site Scripting driven by insufficient output escaping mechanisms. The core technical flaw resides in how the application handles user-supplied input via the 'keyword' parameter derived from the HTTP GET request superglobal. Rather than implementing robust sanitization and proper encoding for HTML context, the code applies only the sanitize_text_field function to the incoming data. While this function effectively strips out HTML tags and script elements, it fails to neutralize special characters such as double quotes that are critical in breaking out of attribute contexts within an HTML document structure.
The operational mechanism of the exploit relies on the subsequent interpolation of this partially sanitized value directly into a PHP heredoc string, which is then rendered inside the value attribute of a search input field on the page. Because the sanitize_text_field function leaves double quotes intact, an attacker can craft a malicious payload that includes these characters to close the existing value attribute prematurely and inject arbitrary JavaScript code as new attributes or event handlers within the HTML markup. This lack of proper escaping via functions like esc_attr means the browser interprets the injected content not merely as text but as executable script when rendered in the context of the page.
The impact of this vulnerability is significant for users with elevated privileges, particularly those possessing upload_files capabilities such as Authors and Administrators. Although the attack vector requires social engineering to trick a victim into clicking a specially crafted link pointing to endpoints like /wp-admin/media-upload, the resulting execution occurs within an administrative context where sensitive operations are performed. Once triggered, the injected script executes in the security context of the logged-in user, allowing attackers to perform actions on behalf of that user without their knowledge or consent. This can lead to session hijacking, credential theft via keyloggers embedded in the payload, defacement of the admin interface, or further propagation of malware within the WordPress environment by leveraging existing permissions and API endpoints accessible only to authenticated administrators.
From a classification perspective, this flaw aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific technique employed here falls under the sub-category of Reflected XSS where the malicious payload is sent in an HTTP request and reflected back by the web application without being properly encoded for safe display. In terms of offensive security frameworks, this vulnerability facilitates techniques associated with MITRE ATT&CK ID T1059, specifically Command and Scripting Interpretation via JavaScript execution within a browser context. It also relates to T1204, User Execution, as it requires the victim to interact with a malicious link or resource hosted by an attacker.
Mitigation strategies for this vulnerability involve both immediate remediation and long-term defensive coding practices. The most effective solution is to upgrade the Pochipp plugin to version 1.20.3 or later where the developers have presumably addressed the output escaping issue. For environments unable to update immediately, administrators should restrict access to media upload functions and administrative pages using strong authentication methods such as multi-factor authentication to reduce the risk of successful social engineering attacks. Additionally, implementing a Web Application Firewall can provide an additional layer of defense by detecting and blocking requests containing patterns indicative of XSS payloads in query parameters. Developers must ensure that all user-supplied data is escaped appropriately for its specific output context using WordPress-specific functions like esc_attr() when inserting into HTML attributes, rather than relying solely on input sanitization which does not prevent attribute breakout attacks.