Junglewise Threat Intelligence

CVE-2026-6690: LifePress WordPress plugin Stored XSS in lp_update_mds AJAX action

CVE-2026-6690 · Severity: high · CVSS 7.2 · Published 2026-05-12

Executive brief

The LifePress plugin for WordPress, which is used for managing content series and metrics, contains a security flaw that allows unauthorized individuals to inject malicious scripts into the website's administration area. Because the plugin fails to verify the identity of the person sending certain updates, an attacker can remotely plant code that executes when a site administrator views the settings page. This could lead to unauthorized actions being performed on behalf of the administrator, potentially compromising the entire website.

Technical details

The LifePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to a lack of authorization and input validation in the 'lp_update_mds' AJAX action. Specifically, the 'wp_ajax_nopriv_lp_update_mds' hook is registered without any nonce verification or capability checks, allowing unauthenticated remote attackers to modify the 'n' parameter. This parameter, which represents a series name, is stored in the database without sufficient sanitization and is later rendered in the admin settings page without proper output escaping. An attacker can exploit this to inject malicious JavaScript that executes in the context of an authenticated administrator's session. The vulnerability exists in all versions up to and including 2.2.2.

Affected products

  • LifePress LifePress up to, and including, 2.2.2

Timeline

  • 2026-05-12: disclosed
  • 2026-05-12: advisory

References