Executive brief
The Spiffy Plugin is a WordPress extension used to manage events on WordPress sites. A contributor-level user (the lowest standard privilege in WordPress) can inject malicious JavaScript code into event titles that will execute when site administrators or visitors view those events, allowing attackers to steal credentials, redirect users to phishing sites, or compromise site functionality.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the Event Title field of the Spiffy Plugin. An authenticated user with contributor role can inject unsanitized JavaScript payloads (e.g., <image/src/onerror=prompt(10)>) that are permanently stored in the database and executed in the browser of any user viewing the event. The vulnerability stems from insufficient input validation and output encoding in the Event Title field. An attacker with only contributor privileges can exploit this to execute arbitrary JavaScript in the context of logged-in administrators or site visitors, leading to account takeover, session hijacking, or malware distribution. The vendor has released version 5.0.9 as a fix.
Affected products
- Spiffy Plugin Spiffy Plugin before 5.0.9
Timeline
- 2026-08-28: disclosed
- 2026: patched: Version 5.0.9 released