Executive brief
The Investi plugin for WordPress, which provides announcement and accordion features, contains a security flaw that allows users with contributor-level access to inject malicious scripts into website pages. These scripts execute automatically when other users or administrators visit the affected page, potentially leading to unauthorized actions or data theft. This vulnerability impacts all versions of the plugin up to and including 1.0.26.
Technical details
The Investi plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'maximum-num-years' attribute within the 'investi-announcements-accordion' shortcode. The vulnerability exists because the attribute value is read directly and interpolated into a double-quoted HTML attribute without using protective functions like esc_attr() or htmlspecialchars(). An authenticated attacker with Contributor-level permissions or higher can exploit this to inject arbitrary web scripts. These scripts are stored on the server and execute in the context of any user's browser who views the compromised page. A patch has been released in subsequent versions (changeset 3486937).
Affected products
- investi Investi <= 1.0.26
Timeline
- 2026-04-08: disclosed
- 2026-04-08: advisory
References
- https://plugins.trac.wordpress.org/browser/investi/tags/1.0.22/includes/widgets.php
- https://plugins.trac.wordpress.org/browser/investi/tags/1.0.22/includes/widgets.php
- https://plugins.trac.wordpress.org/browser/investi/trunk/includes/widgets.php
- https://plugins.trac.wordpress.org/browser/investi/trunk/includes/widgets.php
- https://plugins.trac.wordpress.org/changeset/3486937/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/51aa0d86-e623-46d1-9d37-a36b4825c071?source=cve