A recently disclosed vulnerability in the “Citations tools” WordPress plugin (versions ≤ 0.3.2) permits an authenticated user with Contributor privileges to store malicious HTML/JavaScript via the plugin’s code shortcode attribute. Stored payloads may execute when rendered to visitors or higher-privileged users, enabling classic stored Cross‑Site Scripting (XSS) impacts. This issue is tracked as CVE-2026-1912 and has a published CVSS score of 6.5 (moderate).

This advisory provides a technical summary, exploitation scenarios, detection queries, mitigation options (including virtual patching via a WAF), and a recovery checklist. The guidance is focused on practical defensive steps; exploit proof-of-concept code is intentionally excluded.

TL;DR — Key Facts

• Vulnerability: Authenticated stored Cross‑Site Scripting (XSS) via the code shortcode attribute.
• Affected software: “Citations tools” WordPress plugin — versions ≤ 0.3.2.
• Privilege required: Contributor account (authenticated).
• CVE: CVE-2026-1912
• CVSS: 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L)
• Impact: Script injection on pages where the shortcode is rendered — possible redirects, content injection, session theft, or actions performed in victims’ browsers.
• Immediate mitigations: Disable or remove the plugin, restrict Contributor capabilities, search and clean stored shortcode attributes, apply WAF rules for virtual patching, audit users and sessions.

Why this matters — stored XSS in a shortcode attribute

Shortcodes let plugins inject HTML or dynamic elements into content with tags like [citation code="..."]. If the plugin accepts a code attribute and outputs it without validation and escaping, a user who can create content (for example, a Contributor) can store HTML/JavaScript that executes when rendered.

Stored XSS is dangerous because the payload persists in your database and can affect many users over time. When Contributor‑level accounts are sufficient to inject payloads, any site allowing public registrations or with weak user controls is exposed.

The attack surface and exploitation scenarios

Common abuse patterns include:

1. Malicious contributor: An attacker registers an account (or compromises one) with Contributor role, inserts a crafted code attribute containing event handlers or scripts, and waits for editors/admins or visitors to render the content.
2. Social engineering: Contributors often request previews or approvals; the preview process may execute the stored payload and target staff rather than anonymous users.
3. Mass impact: If front-end pages render the shortcode without escaping, every visitor to that page may be exposed to redirects, abusive content injection, or cookie/token exfiltration.
4. Secondary attacks: From XSS an attacker can perform actions available to the victim in the browser (submit authenticated requests, modify content when an editor is targeted, etc.).

Technical root cause (high level)

The root cause is lack of input validation/sanitization and lack of proper escaping on output. Typical unsafe patterns include:

• Directly echoing attribute values: echo $atts['code'].
• Using do_shortcode() or similar functions that trust attribute content.
• Storing unfiltered attribute content in the database so the payload persists.

Secure practices: validate attributes, sanitize stored values (e.g., sanitize_text_field() or wp_kses()), and escape output with esc_html() or esc_attr() depending on context.

Interpreting the CVSS vector

Published vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. In plain terms:

• AV:N – Attack via network (HTTP).
• AC:L – Low complexity to craft an exploit once you have an account.
• PR:L – Requires low privileges (Contributor).
• UI:R – Requires user interaction (viewing or previewing content).
• S:C – Scope change possible (can affect other components, escalate impact).

Stored XSS often rates moderate because it requires an authenticated user and interaction, but targeting privileged users or high‑traffic sites can raise the real-world impact significantly.

Immediate checklist — what to do right now

1. IDENTIFY: Search your site for occurrences of the vulnerable shortcode and suspicious code attributes. Use admin search and database queries to find instances.
2. ISOLATE: Remove suspicious content from public view — unpublish or edit posts with risky shortcodes.
3. LIMIT: Temporarily restrict Contributor capabilities. Disable new registrations if not needed and ensure Contributor-created posts require editor review.
4. DISABLE PLUGIN: If unsure, deactivate the plugin to stop shortcode processing and prevent payload execution.
5. VIRTUAL PATCH: Use your WAF to block obvious XSS patterns in the code parameter and other inputs (examples below).
6. SCAN: Run full content scans (database and file system) for script tags, SVG payloads, base64 blobs, and suspicious admin users.
7. AUDIT: Review users and sessions; remove unknown accounts and expire active sessions for privileged roles.
8. BACKUP & INVESTIGATE: Ensure recent backups exist. If compromise is suspected, preserve evidence and follow incident response steps.
9. PATCH WHEN AVAILABLE: Monitor for an official plugin update and test/apply fixes promptly.

Detection: how to spot malicious stored XSS payloads

Indicators to search for:

• Inline HTML tags in content or metadata:
  Review My Order

  0

  Subtotal

  Taxes & shipping calculated at checkout

  Checkout