Urgent: Stored XSS in “Allow HTML in Category Descriptions” (<= 1.2.4) — What WordPress Site Owners Must Do Now

Summary: A stored Cross-Site Scripting (XSS) vulnerability (CVE-2026-0693) has been disclosed in the WordPress plugin “Allow HTML in Category Descriptions” (versions ≤ 1.2.4). An authenticated user with Administrator-level privileges can inject malicious HTML/JavaScript into category descriptions that can later execute in visitors’ or other administrators’ browsers. There is currently no official patch for the vulnerable versions. This advisory explains technical details, threat scenarios, immediate mitigations, detection and clean-up steps, and longer-term hardening from the perspective of a Hong Kong security expert.

Note: If you run this plugin and have an affected version installed, treat this as a high-priority site security task — even though the vulnerability requires administrator privileges, the impact can be significant in practice.

What is the vulnerability?

• Type: Stored Cross-Site Scripting (XSS).
• Affected component: WordPress plugin “Allow HTML in Category Descriptions” — versions ≤ 1.2.4.
• CVE: CVE-2026-0693.
• CVSS: 5.9 (medium), Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L.
• Root cause: The plugin allows administrators to save unfiltered HTML in taxonomy descriptions without proper sanitization or output encoding. Malicious JavaScript stored in a category description can be executed in the context of a page that renders that description (front-end or certain admin views), enabling cookie theft, privilege abuse, or actions performed with the victim’s browser session.

Why this matters: Administrators are trusted accounts. An attacker who compromises an admin account (or tricks an admin to save a crafted description) can persist scripts that victimize other admin users or site visitors. Consequences include site defacement, credential harvesting, malicious redirects, or full site takeover through chained attacks.

How an attacker can exploit this

1. Attacker obtains or compromises an Administrator account (phishing, password reuse, insider), or tricks an admin into saving a payload.
2. Through the plugin interface (category edit screen) or another entry point that updates taxonomy descriptions, the attacker injects a payload into the category description field — e.g., , an SVG with an onload/onerror handler, or attribute-based payloads such as onmouseover, srcset, or javascript: URIs.
3. The payload is stored in the database (term_taxonomy.description).
4. When an admin or visitor views the category page (or any admin page rendering that description), the script runs in their browser within the site’s origin.
5. Possible attacker actions include:
   • Collect cookies/localStorage and send them to a remote server.
   • Use the victim’s authenticated browser session to call WordPress REST/AJAX endpoints (potentially creating users, installing plugins, modifying options) if nonce or capability checks are weak.
   • Inject further malicious content (ads, redirects, credential harvesting forms) or modify admin pages.

Important nuance: Many WordPress installations set auth cookies as HttpOnly, preventing direct cookie access by JS. However, JavaScript can still perform authenticated XHR/fetch requests if same-origin and nonce protections are absent or if nonces are stolen. Attackers can chain XSS with other weaknesses to escalate impact.

User interaction: Although some reports classify this as requiring user interaction (e.g., an admin visiting a crafted page), stored XSS is persistent and can execute automatically when pages are loaded.

Immediate, prioritized actions (within the next hour)

1. Disable the plugin now

   Go to wp-admin → Plugins and deactivate “Allow HTML in Category Descriptions” immediately. If you cannot access the admin panel, disable via FTP or hosting file manager by renaming the plugin folder: wp-content/plugins/allow-html-in-category-descriptions → append -disabled.

2. Put the site in maintenance mode (if appropriate)

   If you suspect active exploitation (visible redirects, defacement, spam), temporarily block public access while you investigate.

3. Audit and rotate administrative credentials

   Force password resets for all Administrator accounts. Revoke sessions and tokens (Users → All Users → for each admin, “Log out everywhere” or use session-expiry tools). Enforce strong passwords and enable Two-Factor Authentication (2FA) for admin accounts.

4. Block new requests that attempt to save XSS payloads

   If you can deploy request filtering at the host, CDN, or via a Web Application Firewall (WAF), block POST requests that attempt to save category descriptions containing script-like patterns. See suggested WAF rules later in this article.

5. Backup your site (files + DB)

   Create a full backup before modifying or cleaning the site. Export the database and download wp-content and uploads for forensic copies.

6. Scan for indicators of compromise immediately

   Look for unexpected users, unknown files, scheduled tasks (wp_cron jobs), changed option values, and injected content in posts, pages, and taxonomy descriptions.

Investigation: find malicious category descriptions and scope the damage

Category descriptions are stored in the database; search for script-like content quickly.

Using WP-CLI (recommended if you have shell access):

wp db query "SELECT term_taxonomy_id, term_id, description FROM wp_term_taxonomy WHERE description LIKE '%

wp db query "SELECT term_taxonomy_id, term_id, description FROM wp_term_taxonomy WHERE description REGEXP '(script|onerror|onload|javascript:|data:|iframe|svg|img)';"

 'category',
  'hide_empty' => false,
) );

$allowed_tags = array(
  'a' => array('href' => true, 'title' => true, 'rel' => true, 'target' => true),
  'b' => array(),
  'strong' => array(),
  'i' => array(),
  'em' => array(),
  'p' => array(),
  'br' => array(),
  'ul' => array(),
  'ol' => array(),
  'li' => array(),
  'span' => array('class' => true),
  // add only tags/attributes you trust
);

foreach ( $terms as $term ) {
    $clean = wp_kses( $term->description, $allowed_tags );
    if ( $clean !== $term->description ) {
        wp_update_term( $term->term_id, 'category', array('description' => $clean) );
        echo "Cleaned term {$term->term_id}
";
    }
}
?>

wp eval-file sanitize-term-descriptions.php

# Block attempts to save category descriptions containing 
			
				
			
					

							
			
			
			





		

		
					
				 
 
   
 
  
 
 Review My Order
 0 
 
 
  
 
 
  
 
 
 
 Subtotal
 
Taxes & shipping calculated at checkout
 
 
  
 
 
 
   Checkout