CVE-2026-77820

Received Received - Intake

Stored XSS in WPComplete WordPress Plugin via Empty Shortcode

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: Wordfence

Description

The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and including, 2.9.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the premium version of the software in order to exploit. Please note this only affects the pro version.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-77820

Affected Vendors & Products

Vendor	Product	Version / Range
wpcomplete	plugin	to 2.9.9.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

The WPComplete WordPress plugin has a stored cross-site scripting vulnerability due to insufficient input sanitization and output escaping in the 'empty' shortcode attribute. This allows authenticated attackers with contributor-level access or higher to inject malicious scripts into pages. The vulnerability only affects the premium version of the plugin.

Detection Guidance

This vulnerability requires manual inspection of WordPress sites using the WPComplete plugin. Check for the presence of the plugin in your WordPress installation and verify its version. If using version 2.9.9.0 or lower, the site is vulnerable. Inspect pages for injected scripts in the 'empty' shortcode attribute. No specific commands are provided for automated detection.

Impact Analysis

If exploited, this vulnerability could allow attackers to inject malicious scripts into your WordPress pages. When users access these pages, the scripts could execute, potentially stealing session cookies, redirecting users to malicious sites, or performing actions on their behalf.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, which may violate GDPR and HIPAA compliance requirements. GDPR requires protecting user data, while HIPAA mandates safeguarding protected health information. A successful exploit could result in data breaches, leading to legal and financial penalties.

Mitigation Strategies

Update the WPComplete plugin to the latest version beyond 2.9.9.0 to address the Stored Cross-Site Scripting vulnerability. If using the premium version, ensure you have applied the latest security patches. Remove or restrict contributor-level access to users who do not require it.

Hi! I’m here to help you understand CVE-2026-77820. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70