CVE-2026-9620

Deferred Deferred - Pending Action

Stored XSS in WP Latest Posts WordPress Plugin

Publication date: 2026-06-24

Last updated on: 2026-06-25

Assigner: Wordfence

Description

The WP Latest Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted image src attributes in post content in versions up to, and including, 5.0.11. This is due to insufficient output escaping in the field() and loop() functions, which extract the raw src attribute value from <img> tags within post_content using a regular expression and then reconstruct new <img> elements or CSS background-image declarations by directly concatenating the unescaped value — bypassing WordPress's kses filtering entirely. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-06-25

Generated

2026-07-14

AI Q&A

2026-06-24

EPSS Evaluated

2026-07-13

NVD

CVE-2026-9620

EUVD

EUVD-2026-38684

Affected Vendors & Products

Vendor	Product	Version / Range
wp_latest_posts	plugin	to 5.0.11 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

The WP Latest Posts plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 5.0.11. This occurs because the plugin does not properly escape output when handling image src attributes in post content. Specifically, the field() and loop() functions extract raw src attribute values from <img> tags using a regular expression and then reconstruct new <img> elements or CSS background-image declarations by directly concatenating these unescaped values. This bypasses WordPress's built-in filtering, allowing authenticated users with author-level access or higher to inject malicious scripts that execute whenever a user views the affected page.

Impact Analysis

This vulnerability allows attackers with author-level access or higher to inject arbitrary web scripts into pages. These scripts execute in the context of users who visit the injected pages, potentially leading to theft of user credentials, session hijacking, defacement, or distribution of malware. Because the attack is stored, the malicious code persists and affects all users who access the compromised content.

Compliance Impact

The vulnerability in the WP Latest Posts plugin allows authenticated attackers with author-level access to inject arbitrary web scripts via stored cross-site scripting (XSS). This can lead to unauthorized access to user data or session hijacking when users access the injected pages.

Such unauthorized access and potential data exposure could impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access and ensuring data integrity.

However, the provided information does not explicitly detail the compliance implications or specific regulatory impacts of this vulnerability.

Hi! I’m here to help you understand CVE-2026-9620. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70