Executive brief
WP Emmet, a WordPress plugin that provides Emmet support for the site editor, contains a security vulnerability that could allow an attacker to inject malicious scripts. An attacker with administrative privileges can use this flaw to execute code in the browser of other users, potentially leading to unauthorized actions or data theft. While the risk is mitigated by the requirement for high-level access and user interaction, it remains a threat to site integrity.
Technical details
WP Emmet versions 0.3.4 and earlier are vulnerable to a stored Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation (CWE-79). The vulnerability requires an attacker to have Administrator-level privileges to inject malicious payloads. Successful exploitation also requires user interaction, such as a victim visiting a specific page where the script is executed. This can lead to the execution of arbitrary JavaScript in the context of the victim's session. As of the advisory date, no official patch has been released.
Affected products
- WP Emmet WP Emmet <= 0.3.4
Timeline
- 2025-06-26: other: Vulnerability reported by researcher
- 2025-08-16: advisory: Initial Patchstack advisory published
- 2026-06-15: disclosed: CVE published to NVD dataset