Executive brief
The User Access Manager plugin for WordPress, used to restrict content access within WordPress sites, contains a reflected cross-site scripting vulnerability. An unauthenticated attacker can inject malicious scripts through a crafted link; if a site administrator clicks the link, the attacker gains the ability to perform administrative actions or steal sensitive data on behalf of that user.
Technical details
The vulnerability is a reflected XSS flaw in the 'tab_group_section' parameter, caused by insufficient input sanitization and output escaping in the plugin's backend controller. The attack vector is network-based and does not require authentication; however, it does require social engineering to trick a user into clicking a malicious link. An unauthenticated attacker can inject arbitrary JavaScript code that executes in the context of a logged-in administrator's browser session, potentially leading to account compromise or unauthorized modifications to site settings. Patches are available in versions after 2.3.18.
Affected products
- User Access Manager User Access Manager up to and including 2.3.18
Timeline
- 2026-09-09: disclosed