Description
The JSON API User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter of the post_comment API endpoint in versions up to, and including, 4.1.0 This is due to insufficient input sanitization in the post_comment() function, which passes the attacker-controlled comment_content value directly to wp_insert_comment() without applying any HTML sanitization, and additionally allows the caller to set comment_approved=1 to self-approve the comment and bypass moderation. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2026-07-03
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The JSON API User plugin for WordPress exposes a stored cross‑site scripting flaw in the post result, any user who views a page that displays that comment will execute the embedded script, leading to a stored XSS event. The weakness is classified under CWE‑79.

Affected Systems

Affected are sites running the parorrey JSON API User plugin on WordPress with versions up to and including 4.1.0. The flaw applies to any user having subscriber‑level access or higher who can invoke the post_comment API, which is common on many installations that enable comment posting through the API.

Risk and Exploitability

The vulnerability carries a CVSS score of 6.4, indicating moderate severity, while its EPSS score of < 1% suggests a very low exploitation probability in the wild. It is not listed in CISA’s KEV catalog. The attack requires only authenticated subscriber‑level credentials; therefore, once a comment is inserted and approved, the malicious script persists until removal. The lack of input sanitization directly aligns with CWE‑79.

Generated by OpenCVE AI on July 21, 2026 at 10:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the JSON API User plugin to a version newer than 4.1.0 to apply the vendor‑supplied input sanitization fix that removes the CWE‑79 flaw.
  • If upgrading is not possible, restrict subscriber users from publishing comments via the API or enable a comment moderation queue to prevent auto‑approval.
  • When the plugin is no longer required for site functionality, disable or remove it entirely to eliminate the attack surface.
  • As a temporary defense, deploy an adjusted content security policy to block or strip script tags from comment payloads, mitigating the XSS risk until a patch is available.

Generated by OpenCVE AI on July 21, 2026 at 10:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 03 Jul 2026 08:00:00 +0000

Type Values Removed Values Added
First Time appeared Parorrey
Parorrey json Api User
Wordpress
Wordpress wordpress
Vendors & Products Parorrey
Parorrey json Api User
Wordpress
Wordpress wordpress

Fri, 03 Jul 2026 05:30:00 +0000

Type Values Removed Values Added
Description The JSON API User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter of the post_comment API endpoint in versions up to, and including, 4.1.0 This is due to insufficient input sanitization in the post_comment() function, which passes the attacker-controlled comment_content value directly to wp_insert_comment() without applying any HTML sanitization, and additionally allows the caller to set comment_approved=1 to self-approve the comment and bypass moderation. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Title JSON API User <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' Parameter
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

Parorrey Json Api User
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-07-06T16:35:54.457Z

Reserved: 2026-05-26T17:20:23.199Z

Link: CVE-2026-9626

cve-icon Vulnrichment

Updated: 2026-07-06T16:35:50.124Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-21T10:30:04Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')