CVE-2026-0594
Reflected XSS in List Site Contributors Plugin
Publication date: 2026-01-14
Last updated on: 2026-01-14
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mallsop | list_site_contributors | to 1.1.8 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources and context do not contain information regarding the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
The vulnerability in the List Site Contributors WordPress plugin (up to version 1.1.8) is a Reflected Cross-Site Scripting (XSS) issue via the 'alpha' parameter. Due to insufficient input sanitization and output escaping, an unauthenticated attacker can inject arbitrary web scripts into pages. These scripts execute if a user is tricked into performing an action like clicking a malicious link.
How can this vulnerability impact me? :
This vulnerability can allow attackers to execute malicious scripts in the context of the affected website, potentially leading to theft of user credentials, session hijacking, defacement, or redirection to malicious sites. Since the attack requires tricking a user into clicking a crafted link, it can compromise user trust and site integrity without requiring authentication.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the WordPress site is running the List Site Contributors plugin version 1.1.8 or earlier. Since the vulnerability involves the 'alpha' parameter being vulnerable to reflected cross-site scripting (XSS), you can test for it by sending crafted HTTP requests that include script payloads in the 'alpha' parameter and observing if the script is reflected in the response without proper sanitization. For example, you can use curl or a browser-based tool to send a request like: curl -i 'http://yourwordpresssite.com/?alpha=<script>alert(1)</script>' and check if the script executes or appears in the response. Additionally, scanning your WordPress plugins for the version of List Site Contributors can be done via WP-CLI commands such as: wp plugin list --status=active and verifying the version of list-site-contributors. If the version is 1.1.8 or below, the site is vulnerable.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the List Site Contributors plugin to a version later than 1.1.8 where the vulnerability is fixed. If an update is not available, consider disabling the plugin temporarily to prevent exploitation. Additionally, you can implement web application firewall (WAF) rules to block malicious input in the 'alpha' parameter to prevent reflected XSS attacks. Educate users to avoid clicking on suspicious links that may exploit this vulnerability.