CVE-2026-92967

Received Received - Intake

Reflected XSS in Pochipp WordPress Plugin

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: Wordfence

Description

The Pochipp plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'keyword' parameter in versions up to, and including, 1.20.2. This is due to insufficient output escaping , which reads $_GET['keyword'], applies only sanitize_text_field() (which strips tags but leaves double quotes intact) and interpolates the value directly into the value attribute of the search input via a PHP heredoc, without esc_attr(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user with upload_files capability (Author or above) into performing an action such as clicking on a specially crafted link to /wp-admin/media-upload.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-92967

Affected Vendors & Products

Vendor	Product	Version / Range
pochipp	pochipp	to 1.20.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

The Pochipp WordPress plugin up to version 1.20.2 has a reflected Cross-Site Scripting (XSS) vulnerability in the 'keyword' parameter. The plugin uses insufficient output escaping when processing user input from the GET request. It applies sanitize_text_field() which removes HTML tags but leaves double quotes, then directly inserts the value into a PHP heredoc without proper escaping like esc_attr(). This allows unauthenticated attackers to inject malicious scripts.

Detection Guidance

To detect this vulnerability, inspect WordPress sites using the Pochipp plugin version 1.20.2 or lower. Check for reflected XSS via the 'keyword' parameter in URLs or search inputs. Manually review plugin files for unsanitized GET parameters in PHP heredoc outputs.

Impact Analysis

An attacker could trick a logged-in user with upload_files capability (Author or higher) into clicking a malicious link. This could lead to execution of arbitrary JavaScript in their browser session. The impact includes potential theft of session cookies, account takeover, or redirection to phishing sites.

Compliance Impact

This XSS vulnerability could lead to unauthorized access to user data, violating GDPR's integrity and confidentiality principles. For HIPAA, it may compromise protected health information if exploited. Both regulations require protection against such attacks to maintain data security and privacy.

Mitigation Strategies

Immediately update the Pochipp plugin to the latest version. If no update is available, disable or remove the plugin. Implement input validation and output escaping for all user-supplied data in WordPress plugins.

Hi! I’m here to help you understand CVE-2026-92967. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70