TL;DR — A stored Cross-Site Scripting (XSS) vulnerability (CVE-2026-1888, CVSS 6.5) affects Docus plugin versions ≤ 1.0.6. An authenticated user with Contributor privileges can inject malicious script via shortcode attributes which may execute when content is rendered by higher-privilege users or site visitors. Upgrade to Docus 1.0.7 immediately. Below are technical details, detection steps and mitigations from a Hong Kong information‑security perspective.

Contexte et arrière-plan

On 6 February 2026 a stored Cross-Site Scripting (XSS) issue in the Docus WordPress plugin (≤ 1.0.6) was publicly disclosed. The vulnerability allows an authenticated user with Contributor privileges to embed JavaScript in shortcode attributes which the plugin later outputs unsanitized. The payload is stored in the database and executed when content is rendered in contexts such as previews, editor screens or the frontend. Stored XSS enables session theft, privilege escalation and persistent compromise — treat it seriously in multi-author or agency-managed sites.

Résumé de la vulnérabilité

• Vulnérabilité : Authenticated (Contributor) Stored Cross-Site Scripting via shortcode attributes
• Logiciel affecté : Docus WordPress plugin versions ≤ 1.0.6
• Corrigé dans : 1.0.7 (update immediately)
• CVE : CVE-2026-1888
• CVSS : 6.5 (Moyen)
• Privilèges requis : Contributeur (authentifié)
• Exploitation : Stored XSS — requires a suitable viewer (Editor/Admin or site visitor) to render the content

How the vulnerability works (technical analysis)

WordPress shortcodes replace bracketed tags like [docus attr="value"] with generated HTML. A secure handler sanitises inputs and escapes outputs using functions such as sanitize_*, esc_* et wp_kses. The Docus issue arises because attribute values submitted by a Contributor are stored and later printed into HTML without proper escaping (for example, missing esc_attr() when used inside attributes).

Flux d'attaque typique :

1. Contributor saves a draft or content containing a Docus shortcode with crafted attributes, e.g. [docus title='<img src="x" onerror="">']
2. The content is stored in the database.
3. When an Editor/Admin previews or opens the post (or a visitor views the published page), the plugin processes the shortcode and outputs the attribute value unsanitized.
4. The injected payload executes in the viewer’s browser, within their session context.

Points clés :

• XSS stocké — la charge utile persiste dans la base de données.
• Attacker needs an account with Contributor privileges (or equivalent).
• Execution may occur in multiple contexts: editor UI, preview pane, admin screens, or frontend.

Exploitation preconditions and user interaction

• Attacker must have a Contributor account (or similar role that can save shortcodes in content).
• Exploit triggers when a higher-privilege user (Editor/Admin) or a site visitor renders the content.
• Sites that accept contributions from third parties, guest writers or multiple authors are higher risk.

Attack scenarios and real risk to WordPress sites

1. Administrative account takeover

   An attacker injects JavaScript into a draft. An Editor opens the editor or preview; the script runs, exfiltrates REST nonces or cookies, and the attacker reuses those values to perform privileged actions (create admin users, change settings).

2. Persistent defacement or spam

   A payload in published content can redirect visitors, inject spam, or display malicious content, harming users and search reputation.

3. Privilege escalation and persistent infection

   XSS can enable CSRF-like actions in admin contexts to create backdoors or modify themes/plugins.

4. Reputation and SEO impact

   Search engines or browsers may flag or blacklist the site if malicious content is served.

Although CVSS rates this as medium, the practical risk is high for sites with Contributor roles or untrusted content submission workflows.

Actions immédiates pour les propriétaires de sites et les administrateurs

1. Upgrade Docus immediately. Update to version 1.0.7 or later. This is the primary remediation.
2. Si vous ne pouvez pas mettre à jour immédiatement : deactivate or remove the plugin in production; restore from a tested backup in a staging environment to validate changes first.
3. Restrict Contributor capabilities (temporary). Remove untrusted Contributor accounts or restrict their ability to insert shortcodes.
4. Audit recent content created by Contributors. Search drafts and recent posts for suspicious shortcodes or attributes and quarantine suspect entries.
5. Scan for malicious content patterns. Rechercher <script>, onerror=, javascript :, données:text/html and similar patterns inside posts.
6. Consider virtual patching via a WAF. If you have a WAF or protection provider, deploy short-term rules to block typical exploit payloads while you update — see examples below. Note: this is compensating control, not a replacement for the patch.
7. Si une compromission est suspectée : rotate admin passwords, invalidate active sessions, and rotate keys/salts in wp-config.php to force re-authentication.

Detection: how to find whether you’re impacted

Search the contenu_du_post of wp_posts for Docus shortcodes and suspicious attributes. Examples:

SQL queries

SELECT ID, post_title, post_type, post_status FROM wp_posts WHERE post_content LIKE '%[docus%';

SELECT ID, post_title FROM wp_posts
WHERE post_content LIKE '%[docus%'
AND post_content REGEXP '(<|on[a-z]+=|javascript:)';

WP-CLI

wp post list --post_status=draft,pending,publish --format=csv --fields=ID,post_title,post_status,post_author | grep -i docus

PHP inspection (admin)

<?php
$posts = get_posts(['post_status' => ['draft', 'pending', 'publish'], 's' => '[docus']);
foreach ($posts as $p) {
    if (preg_match('/on[a-z]+=|<script|javascript:/i', $p->post_content)) {
        // flag for manual review
    }
}
?>

Treat any discovered instances created by untrusted users as potentially malicious: quarantine the post (set to draft) and investigate further.

Renforcement et atténuations à long terme

• Limit who can use shortcodes. Prevent low‑trust roles from inserting or editing shortcodes. As a short-term measure you can remove the shortcode handler during the review period:

  add_action('init', function() { remove_shortcode('docus'); });

  (Use only if this does not break required functionality.)

• Sanitise and escape everywhere. Enforce sanitisation on input and escaping on output in all code paths.
• Review roles and workflows. Implement review/publish workflows that minimise the chance an Editor/Admin will open untrusted content in an unsafe context.
• Deploy compensating controls. Use WAF rules, content filters and monitoring to reduce exposure while applying the permanent fix.
• Ongoing monitoring. Schedule periodic scans for known XSS patterns and review shortcodes in stored content.
• Keep Core, plugins and themes updated. Regular patching remains the most reliable defence.

Developer guidance: secure fix patterns and code examples

If you maintain shortcode handlers, apply these principles:

• Sanitise attribute input early with sanitize_text_field() or appropriate filters.
• If limited HTML is allowed, use wp_kses() avec une liste blanche explicite.
• Escape attribute values with esc_attr() and body text with esc_html() ou wp_kses_post().

Examples

// Sanitize attribute:
$title = isset($atts['title']) ? sanitize_text_field($atts['title']) : '';

// Whitelist allowed tags:
$allowed = [
    'a' => ['href' => true, 'title' => true, 'rel' => true],
    'br' => [],
    'strong' => [],
    'em' => [],
];
$content = wp_kses($atts['content'], $allowed);

// Escape on output:
printf('<div data-title="%s">', esc_attr($title));
echo '<div class="docus-title">' . esc_html($title) . '</div>';

// Secure shortcode handler:
function docus_shortcode_handler( $atts = [], $content = null ) {
    $atts = shortcode_atts( ['title' => ''], $atts, 'docus' );
    $title = sanitize_text_field( $atts['title'] );
    return '<div class="docus" data-title="' . esc_attr( $title ) . '">' . wp_kses_post( $content ) . '</div>';
}

Validez les URL avec esc_url_raw() ou filter_var() as appropriate. Add unit and integration tests to assert that attributes with angle brackets or event handlers are rejected or escaped.

WAF and virtual-patch rules (examples)

Below are generic detection and blocking patterns you can adapt to your firewall or intrusion prevention system. Test rules on staging before production deployment.

Rule concept — block POSTs containing dangerous shortcode attributes

Target POSTs to endpoints used to create or update content: /wp-admin/post.php, /wp-admin/post-new.php, /wp-admin/admin-ajax.php.

Condition:
Request method is POST AND Request URI matches /wp-admin/(post.php|post-new.php|admin-ajax.php)
AND Request body matches (PCRE):
\[docus[^\]]*(?:\s+\w+\s*=\s*['"][^'"]*(?: