Junglewise Threat Intelligence

CVE-2026-4267: Johnbillion Query Monitor Reflected XSS in REQUEST_URI

CVE-2026-4267 · Severity: high · CVSS 7.2 · Published 2026-03-31

Vendors: Packagist.

Executive brief

Query Monitor, a popular WordPress plugin used by developers to debug and analyze website performance, is vulnerable to a security flaw that allows attackers to run malicious scripts in a user's browser. By tricking a site administrator into clicking a specially crafted link, an attacker can execute commands with the administrator's permissions. This could lead to the unauthorized creation of new admin accounts, theft of sensitive session information, or full takeover of the WordPress website.

Technical details

The Query Monitor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping of the '$_SERVER[REQUEST_URI]' parameter. Specifically, the 'format_url' function contains a logic flaw where it fails to HTML-escape strings that do not contain an ampersand, returning the raw, attacker-controlled string instead. An unauthenticated attacker can exploit this by crafting a URL containing a malicious script payload and tricking a logged-in administrator into visiting it. Because the script executes within the context of the WordPress administrative interface, the attacker can bypass CSRF protections (nonces), modify site settings, or create new administrative users.

Affected products

  • johnbillion Query Monitor <= 3.20.3

Timeline

  • 2026-03-16: other: Vulnerability detected and developer contacted
  • 2026-03-30: disclosed: CVE-2026-4267 registered and public disclosure
  • 2026-03-31: advisory: NVD and Wordfence advisories published

References