CVE-2026-1805
Stored XSS in DA Media GigList WordPress Plugin Allows Script Injection
Publication date: 2026-03-07
Last updated on: 2026-03-07
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| da_media | dmedia_giglist | to 1.9.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The DA Media GigList plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in all versions up to and including 1.9.0. This vulnerability arises because the plugin does not properly sanitize or escape user-supplied attributes in its damedia_giglist shortcode.
As a result, authenticated users with contributor-level access or higher can inject malicious scripts into pages. These scripts will execute whenever any user views the affected page, potentially compromising user data or site integrity.
How can this vulnerability impact me? :
This vulnerability can allow attackers with contributor-level access or above to inject arbitrary web scripts into pages on your WordPress site.
When other users visit these pages, the injected scripts will execute in their browsers, which can lead to theft of sensitive information, session hijacking, defacement, or other malicious actions.
The CVSS v3.1 base score of 6.4 indicates a medium severity impact, with low attack complexity and no user interaction required for exploitation.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability involves Stored Cross-Site Scripting (XSS) via the damedia_giglist shortcode in the DA Media GigList WordPress plugin versions up to 1.9.0. Detection typically involves identifying if the vulnerable plugin version is installed and if any user-supplied attributes in the shortcode contain malicious scripts.'}, {'type': 'paragraph', 'content': 'Since the vulnerability requires authenticated users with contributor-level access or higher to inject scripts, detection can include reviewing shortcode usage in posts or pages for suspicious script tags or unusual attributes.'}, {'type': 'paragraph', 'content': 'There are no explicit detection commands or tools provided in the available resources. However, general approaches include:'}, {'type': 'list_item', 'content': 'Checking the installed plugin version via WordPress admin or command line (e.g., WP-CLI): `wp plugin list | grep damedia-giglist`'}, {'type': 'list_item', 'content': 'Searching the WordPress database for instances of the damedia_giglist shortcode containing suspicious script tags, for example using SQL queries on the `wp_posts` table:'}, {'type': 'list_item', 'content': "```sql\nSELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%[damedia_giglist%<script%';\n```"}, {'type': 'list_item', 'content': 'Monitoring web traffic for suspicious script execution or unusual POST requests from authenticated users with contributor or higher roles.'}, {'type': 'paragraph', 'content': 'No specific detection commands or automated tools are referenced in the provided resources.'}] [1, 2, 3]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'To mitigate this Stored Cross-Site Scripting vulnerability in the DA Media GigList plugin (versions up to 1.9.0), immediate steps include:'}, {'type': 'list_item', 'content': 'Update the DA Media GigList plugin to a version that patches this vulnerability, if available.'}, {'type': 'list_item', 'content': 'If an update is not yet available, restrict contributor-level and higher user permissions to trusted users only, as the vulnerability requires authenticated users with contributor or higher privileges.'}, {'type': 'list_item', 'content': 'Temporarily disable or remove the damedia_giglist shortcode usage in posts or pages to prevent exploitation.'}, {'type': 'list_item', 'content': "Implement Web Application Firewall (WAF) rules to detect and block malicious script injections targeting this plugin's shortcode."}, {'type': 'list_item', 'content': 'Review and sanitize any existing content using the damedia_giglist shortcode to remove injected scripts.'}, {'type': 'paragraph', 'content': 'No explicit mitigation instructions or patches are detailed in the provided resources.'}] [1, 2, 3]