Junglewise Threat Intelligence

CVE-2026-13042: yo35 RPB Chessboard Stored XSS via Comment Content

CVE-2026-13042 · Severity: high · CVSS 7.2 · Published 2026-07-16

Executive brief

The RPB Chessboard plugin for WordPress, which allows users to display chess games on their websites, is vulnerable to a security flaw in its comment handling. An attacker can post a specially crafted comment that injects malicious scripts into the website. When other users or administrators view the page where the comment was posted, the script executes, potentially leading to unauthorized actions or data theft.

Technical details

The RPB Chessboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the comment content filter in versions up to 8.1.2. The vulnerability exists because the plugin's 'comment_text' filter synthesizes dangerous HTML at render time, bypassing WordPress's standard 'kses' sanitization which only checks content at save time. An unauthenticated attacker can use allowed tags and attributes to craft a payload that breaks out of HTML attributes during rendering. This allows for the execution of arbitrary JavaScript in the context of a user's browser session when they visit the affected page. A patch has been released in subsequent versions.

Affected products

  • yo35 RPB Chessboard up to, and including, 8.1.2

Timeline

  • 2026-07-16: advisory: NVD publication date
  • 2026-07-16: disclosed: Wordfence advisory published

References