CVE-2026-0594
📋 TL;DR
The List Site Contributors WordPress plugin has a reflected cross-site scripting vulnerability in versions up to 1.1.8. Unauthenticated attackers can inject malicious scripts via the 'alpha' parameter, potentially stealing user credentials or session cookies when victims click specially crafted links. This affects all WordPress sites using vulnerable versions of the plugin.
💻 Affected Systems
- WordPress List Site Contributors plugin
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator credentials, gain full site control, install backdoors, or redirect users to malicious sites.
Likely Case
Session hijacking, credential theft from users who click malicious links, or defacement of specific pages.
If Mitigated
Limited impact if users have script blockers, modern browsers with XSS filters, or clickjacking protection.
🎯 Exploit Status
Simple reflected XSS requiring user interaction via crafted URL.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.9 or later
Vendor Advisory: https://plugins.trac.wordpress.org/browser/list-site-contributors/trunk/list-site-contributors.php
Restart Required: No
Instructions:
1. Log into WordPress admin dashboard
2. Navigate to Plugins → Installed Plugins
3. Find 'List Site Contributors' plugin
4. Click 'Update Now' if available
5. Alternatively, download version 1.1.9+ from WordPress repository and manually update
🔧 Temporary Workarounds
Input Validation via .htaccess
linuxBlock requests containing script tags in the alpha parameter
RewriteCond %{QUERY_STRING} alpha=.*[<\"'].* [NC]
RewriteRule ^ - [F]
🧯 If You Can't Patch
- Disable the List Site Contributors plugin immediately
- Implement Content Security Policy (CSP) headers to restrict script execution
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → List Site Contributors version number. If ≤1.1.8, vulnerable.Check Version:
wp plugin list --name='list-site-contributors' --field=versionVerify Fix Applied:
Confirm plugin version is 1.1.9 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- HTTP requests with 'alpha' parameter containing script tags or encoded payloads
- Unusual referrer URLs with long encoded parameters
Network Indicators:
- GET requests to WordPress pages with suspicious 'alpha' parameter values
SIEM Query:
http.url:*alpha=* AND (http.url:*script* OR http.url:*%3C* OR http.url:*javascript*)🔗 References
- https://plugins.trac.wordpress.org/browser/list-site-contributors/tags/1.1.8/list-site-contributors.php#L435
- https://plugins.trac.wordpress.org/browser/list-site-contributors/trunk/list-site-contributors.php#L435
- https://www.wordfence.com/threat-intel/vulnerabilities/id/026a2e0d-4d30-4133-9118-055026aa9f4a?source=cve
