Executive brief
Voyage Plus, a WordPress plugin used for site layout and content management, contains a security flaw that allows users with contributor-level access to inject malicious scripts into website pages. These scripts execute automatically whenever a visitor views the affected page, potentially leading to unauthorized actions or data theft. This could compromise the integrity of the website and the security of its visitors.
Technical details
The Voyage Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'class' attribute within the 'post-content' shortcode. This vulnerability exists in all versions up to and including 1.0.6. An authenticated attacker with contributor-level permissions or higher can exploit this by injecting malicious JavaScript into the shortcode attribute. Because the input is stored and later rendered without proper neutralization (CWE-79), the script executes whenever a user navigates to the compromised page. The attack requires network access to the WordPress administrative interface but does not require victim interaction beyond viewing the page.
Affected products
- Voyage Plus Voyage Plus Up to, and including, 1.0.6
Timeline
- 2026-05-12: disclosed: Initial disclosure of the vulnerability.
- 2026-05-12: advisory: NVD and Wordfence published advisory details.