Executive brief
The rexCrawler plugin for WordPress, which is used for web crawling and content management, contains a security flaw that allows administrators to inject malicious scripts into the website's settings. If exploited, these scripts could execute in the browsers of other users, potentially leading to unauthorized actions or data theft. This issue primarily affects WordPress multi-site environments or specific configurations where standard security restrictions on HTML content have been relaxed.
Technical details
The rexCrawler plugin for WordPress (up to version 1.0.15) is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping within the admin settings component. An authenticated attacker with administrator-level privileges can inject arbitrary web scripts into the plugin's configuration pages. These scripts execute whenever a user visits the affected settings page. This vulnerability specifically impacts WordPress multi-site installations and single-site installations where the 'unfiltered_html' capability has been disabled for administrators. The flaw is rooted in the 'admin_main.php' file where user-supplied data is not properly handled before being stored and rendered.
Affected products
- rexCrawler rexCrawler Up to and including 1.0.15
Timeline
- 2026-05-27: disclosed: Initial disclosure by Wordfence
- 2026-05-27: advisory: NVD publication date
References
- https://plugins.trac.wordpress.org/browser/rexcrawler/tags/1.0.15/admin_main.php
- https://plugins.trac.wordpress.org/browser/rexcrawler/tags/1.0.15/admin_main.php
- https://plugins.trac.wordpress.org/browser/rexcrawler/trunk/admin_main.php
- https://plugins.trac.wordpress.org/browser/rexcrawler/trunk/admin_main.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/9ec307de-600c-4fb2-b474-db9b674d4ead?source=cve