Executive brief
The 12 Step Meeting List plugin is a widely-used WordPress plugin that manages meeting information for 12-step programs. An unauthenticated attacker can inject malicious JavaScript code into the plugin, which is then executed in visitors' browsers, potentially stealing account credentials, session tokens, or personal data without requiring any special permissions or interaction beyond visiting a malicious page.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw in the 12 Step Meeting List WordPress plugin affecting versions 3.19.16 and earlier. The plugin fails to properly sanitize and escape user-controlled input, allowing unauthenticated attackers to inject arbitrary JavaScript into the site. The attack requires only network access and can be delivered via a crafted URL or page element; user interaction (such as clicking a link or visiting a page) is required for the payload to execute. Successful exploitation allows an attacker to steal session cookies, perform actions on behalf of logged-in users, or hijack visitor accounts. The vulnerability was patched in version 3.19.17, released on 20 August 2026.
Affected products
- Code for Recovery 12 Step Meeting List 3.19.16 and earlier
Timeline
- 2026-08-24: disclosed
- 2026-08-20: patched: Version 3.19.17 released