CVE-2026-91862

Executive Summary

CVE-2026-91862 is a stored cross-site scripting (XSS) vulnerability in the "Getwid – Gutenberg Blocks" plugin for WordPress, affecting all versions up to and including 3.0.1. The flaw resides in the plugin's handling of the data-image-points parameter, which is not sufficiently sanitized on input or escaped on output, allowing an authenticated attacker with contributor-level privileges or higher to persist arbitrary JavaScript into a page. Successful exploitation results in script execution in the browser context of any user who views the injected page, enabling session theft, content manipulation, and potential administrative account compromise in targeted follow-on attacks.

Technical Analysis

The vulnerability is a classic stored (persistent) cross-site scripting issue mapped to CWE-79. According to the NVD description, the plugin fails to apply adequate input sanitization to the data-image-points parameter and fails to perform output escaping when that value is rendered back into a page. Because the value is stored server-side (for example, as part of a post's content or block attributes) and then emitted into the HTML response, the malicious payload becomes persistent rather than reflected.

Attack surface characteristics:

• The vulnerable component is the Getwid Gutenberg Blocks plugin for WordPress, meaning exposure is limited to WordPress sites with that plugin installed and active.
• The data-image-points parameter is processed in the context of a specific block/feature. The description does not identify the precise function, class, endpoint, or file path responsible, so no code-level function name is asserted here.
• The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N indicates a network-reachable flaw requiring low privileges, no user interaction on the attacker's side, and a scope change (S:C). The scope change reflects that the injected script executes in the security context of a different component/user than the one that introduced it.
• Low privileges (PR:L) correspond to the contributor-level requirement. Contributors in WordPress can author and submit posts but are normally restricted from publishing or unfiltered HTML — this bug circumvents that trust boundary.

Root cause (vulnerability class): missing/incorrect sanitization of an HTML attribute value on write, combined with missing output encoding on render. This permits an attacker to break out of the intended attribute/data context or inject event handlers, script tags, or markup that the browser executes. Because the sanitization is described as insufficient and the escaping absent, both sides of the data flow are defective.

Confidence note: The description is moderately detailed but does not disclose the exact code location, the specific block it belongs to, or the raw payload shape. Any claim of a specific function name, API route, or file path would be speculation and is deliberately omitted.

Exploitation Scenarios

No public proof-of-concept is available. The attack chain below is inferred strictly from the vulnerability class (stored XSS) and the NVD description.

1. Reconnaissance / target identification An attacker enumerates WordPress sites running the Getwid plugin at version 3.0.1 or lower. Public HTML markers such as references to wp-content/plugins/getwid are used to fingerprint installations. The attacker identifies a target where they can obtain or already hold a contributor-level (or higher) account.

2. Triggering the flaw class Using their authenticated contributor-level session, the attacker submits or edits content that includes the data-image-points parameter with a crafted value. Because the parameter is not adequately sanitized on input, the malicious value is accepted and stored by the plugin/WordPress. The precise block or editor feature that consumes data-image-points is not specified in the source data; the attacker leverages whatever authoring surface accepts that parameter.

3. Payload / execution method (class level) The stored value is later rendered into a page without output escaping. When a victim loads the affected page, the browser parses the injected markup/value and executes the embedded JavaScript in that page's origin. Consistent with standard XSS payloads, this could be a script element, an event handler, or a crafted attribute break-out. No specific payload string is claimed because none is provided.

4. Post-exploitation impact Executing JavaScript in the victim's browser context allows theft of session cookies/tokens, unauthorized actions performed as the victim, defacement, redirection to malicious sites, or credential phishing. Because the injected content is persistent, every visitor of the affected page is a potential victim, and the CVSS scope change (S:C) reflects impact crossing from the contributor's content context into other users' sessions. If an administrator views or is tricked into viewing the page, the attacker may escalate to full site compromise.

Impact Assessment

• Confidentiality (C:L) and Integrity (I:L) impacts are rated Low individually, but the scope change (S:C) means the impact can extend beyond the vulnerable component to other users and the broader WordPress application.
• Availability (A:N) is unaffected: this is not a denial-of-service flaw.
• Exploitation requires only low privileges (PR:L — contributor-level or above) and no interaction from the eventual victim beyond visiting the injected page (UI:N from the attacker's perspective within the vector).
• Business impact includes session hijacking of site visitors and administrators, potential full compromise of the CMS if an admin session is captured, reputational damage from injected/malicious content, and downstream malware hosting or redirection.
• Blast radius: all WordPress sites with Getwid <= 3.0.1 installed and active. Any site that grants contributor access (e.g., multi-author blogs, community platforms) is at elevated risk.
• No CISA KEV listing and no public exploit are currently recorded, which lowers the immediate likelihood of mass exploitation, but stored XSS is trivially automatable once a payload is known.

Detection Guidance

Sigma Rule

title: Getwid Plugin Stored XSS via data-image-points Parameter
id: 9f2c1a74-3b6e-4d2a-8c51-7a0e5d91862c
status: experimental
description: Detects creation or update of WordPress content containing a suspicious data-image-points value consistent with stored XSS in Getwid <= 3.0.1 (CVE-2026-91862)
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91862
author: SOC Detection Engineering
date: 2026/01/01
logsource:
  category: web
  product: wordpress
  service: http
detection:
  selection_path:
    cs-uri-query|contains:
      - 'data-image-points'
  selection_method:
    cs-method:
      - 'POST'
      - 'PUT'
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - 'onerror='
      - 'onload='
      - 'javascript:'
      - 'document.cookie'
  condition: selection_path and selection_method and selection_payload
falsepositives:
  - Legitimate content editors saving benign attribute values
  - Security scanners probing the parameter
level: high
tags:
  - attack.t1059.007
  - cwe.79

YARA Rule

rule CVE_2026_91862_Getwid_XSS
{
    meta:
        description = "Detects stored XSS payload attempts against Getwid data-image-points parameter (CVE-2026-91862)"
        author = "SOC Detection Engineering"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91862"
        date = "2026-01-01"
        severity = "high"

    strings:
        $param = "data-image-points"
        $x1 = "<script" nocase
        $x2 = "javascript:" nocase
        $x3 = "onerror=" nocase
        $x4 = "onload=" nocase
        $x5 = "document.cookie" nocase
        $x6 = "onmouseover=" nocase
        $x7 = "onfocus=" nocase

    condition:
        $param and any of ($x*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-91862 Getwid data-image-points Stored XSS Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri.raw; content:"data-image-points"; nocase; http.request_body; content:"<script"; nocase; http.request_body; content:"data-image-points"; nocase; reference:cve,2026-91862; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91862; classtype:web-application-attack; sid:202691862; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5s
  [network where
     network.protocol == "http" and
     http.request.method in ("POST","PUT") and
     stringContains(http.request.query, "data-image-points")]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=wordpress
(http.method=POST OR http.method=PUT)
| eval combined=coalesce(uri_query, form_data, request_body, "_raw")
| where match(combined, "(?i)data-image-points")
| where match(combined, "(?i)(<script|javascript:|onerror=|onload=|document\.cookie|onmouseover=|onfocus=)")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, user, uri_path, http.method
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,wordpress,">
  <rule id="10091862" level="12">
    <if_sid>31100,31101,31103,31104</if_sid>
    <match>data-image-points</match>
    <regex type="pcre2">(?i)(&lt;script|javascript:|onerror=|onload=|document\.cookie)</regex>
    <description>CVE-2026-91862: Possible Getwid plugin stored XSS attempt via data-image-points parameter</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
    <group>cve_2026_91862,xss,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — a single source, NVD, claims a patch; this is not independently confirmed, no vendor advisory or fixed version string is provided).

1. Immediate mitigations

• If the Getwid plugin is not operationally required, disable and remove it. This eliminates the attack surface entirely.
• Restrict the contributor role: audit and reduce the number of accounts holding contributor-level or higher privileges; apply least privilege so untrusted users cannot author content.
• Enable a WordPress web application firewall (WAF) rule set that blocks XSS payloads and the data-image-points parameter carrying suspicious markup.
• Enforce strong Content Security Policy (CSP) headers to limit the impact of any injected script (note: CSP mitigation is partial, not a fix).
• Require administrators to browse the site with minimal privileges and encourage re-authentication for sensitive actions.

2. Patch / upgrade steps

• Monitor the Getwid plugin source and the WordPress plugin repository for a release beyond 3.0.1. No confirmed fixed version is documented in the source data.
• Once a fixed release is confirmed, upgrade the plugin immediately and verify the fix against the data-image-points parameter handling.
• Because patch confidence is low, validate the upgrade changelog or vendor advisory before relying solely on NVD's claim.

3. Long-term hardening

• Adopt a vulnerability management workflow that tracks plugin CVEs and enforces timely patching of WordPress plugins.
• Deploy output-encoding and input-sanitization controls at the application platform level where feasible.
• Enforce multi-factor authentication for all privileged WordPress accounts.
• Regularly audit user roles and content authoring privileges.
• Log and alert on content submissions containing HTML/script markup from low-privileged users.

References

• NVD — CVE-2026-91862: https://nvd.nist.gov/vuln/detail/CVE-2026-91862
• MITRE CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• WordPress Plugin Security documentation (Hardening): https://developer.wordpress.org/plugins/security/
• Getwid plugin directory (WordPress.org) for availability of a fixed release: https://wordpress.org/plugins/getwid/
• CISA Known Exploited Vulnerabilities Catalog (verify current status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Note: No exploit-in-the-wild evidence, threat actor campaign, PoC, or Nuclei template is recorded for CVE-2026-91862 at the time of writing. CISA KEV status is NO.