Executive brief
The Blog Filter plugin for WordPress, which allows site owners to create filterable blog post galleries, contains a security flaw that allows attackers to inject malicious scripts. If an attacker with basic contributor-level access tricks a site administrator into visiting a specific page, they could execute code in the admin's browser. This could lead to unauthorized site changes, redirection of visitors to malicious websites, or theft of sensitive session information.
Technical details
A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the A WP Life Blog Filter plugin for WordPress due to improper neutralization of user-supplied input during web page generation. The flaw allows an authenticated attacker with 'Contributor' or higher privileges to inject malicious scripts into the site's Document Object Model (DOM). Successful exploitation requires a victim (typically an administrator) to interact with a specially crafted link or page. This can result in the execution of arbitrary JavaScript in the context of the victim's browser session, potentially leading to privilege escalation or data theft. The issue is addressed in version 1.7.7.
Affected products
- A WP Life Blog Filter <= 1.7.6
Timeline
- 2026-01-12: other: Vulnerability reported by researcher Jitlada
- 2026-02-11: advisory: Patchstack published advisory and assigned PSID c49cd669b910
- 2026-04-08: disclosed: CVE-2026-39517 published to NVD
- 2026-04-08: patched: Version 1.7.7 released to address the vulnerability