Security readout for executives and security teams
Plain-English summary
CVE-2026-2121 affects the WordPress Weaver Show Posts plugin through version 1.8.1. An authenticated Administrator can save script content in a widget setting, causing it to run for visitors of affected pages. The business risk is mainly for WordPress multisite environments where site administrators are intentionally restricted from posting unfiltered HTML.
Executive priority
Treat as a targeted medium-priority WordPress issue. It is not broadly unauthenticated, but it matters where many semi-trusted site administrators manage content, especially multisite environments. Address during the next plugin maintenance cycle, faster for externally facing multisite platforms.
Technical view
The issue is stored cross-site scripting in the 'add_class' parameter for the 'Additional Classes to Wrap Posts' widget setting. Sources attribute it to insufficient sanitization and output escaping. CVSS is 4.4, with high privileges required, high attack complexity, changed scope, and low confidentiality and integrity impact.
Likely exposure
Exposure is limited to WordPress sites using Weaver Show Posts versions up to and including 1.8.1. The most relevant scenario is multisite, where Administrator users may not have the unfiltered_html capability. Single-site administrators often already have broad content privileges, reducing incremental impact.
Exploitation context
No KEV listing or provided source indicates active exploitation. Exploitation requires authenticated Administrator-level access or higher. The vulnerability can affect users who view a page where the malicious widget setting has been stored, but the provided sources do not establish public exploitation in the wild.
Researcher notes
The CVE record and Wordfence identify CWE-79 stored XSS via 'add_class'. The source bundle references plugin code locations around the widget implementation. The bundle does not clearly name a fixed version or confirm exploitation, so remediation should be tied to current vendor or WordPress.org plugin guidance.
Mitigation direction
- Inventory WordPress sites for the Weaver Show Posts plugin and installed version.
- Prioritize multisite installations where site administrators lack unfiltered_html capability.
- Check WordPress plugin and vendor guidance for an updated or corrected release.
- Restrict widget administration to trusted users until remediation is confirmed.
- Review affected pages and widgets for unexpected custom class content.
Validation and detection
- Confirm whether Weaver Show Posts is installed on each WordPress instance.
- Verify plugin version is above 1.8.1, if a fixed version is available.
- Review multisite roles and whether administrators lack unfiltered_html.
- Inspect widget settings for suspicious Additional Classes values.
- Monitor WordPress security logs for unexpected widget configuration changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-2121 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N1.32.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4.4MediumVector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e0d525ab-a86d-4750-9d16-731cbc0a626e?source=cveCVE reference
- https://plugins.trac.wordpress.org/browser/show-posts/trunk/includes/posts-widgets.php#L32CVE reference
- https://plugins.trac.wordpress.org/browser/show-posts/tags/1.8.1/includes/posts-widgets.php#L32CVE reference
- https://youtu.be/kbSqUuEAyhoCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.