Executive brief
The BE REST Endpoints WordPress plugin allows unauthenticated attackers to inject malicious scripts into widgets without any authorization or input validation. When site visitors view the page, the injected scripts execute in their browsers, enabling attackers to steal session data, redirect users, or deface content. Additionally, attackers can create, modify, or delete any widget on the site.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the widget REST endpoints of the BE REST Endpoints WordPress plugin. The plugin fails to perform any authorization checks on widget operations and does not sanitize user-supplied input before storing it in the database. Unauthenticated users can craft malicious REST API requests to create or modify widgets containing arbitrary JavaScript code. When an authenticated user or site visitor accesses the page containing the compromised widget, the injected script executes in their browser context. Attack preconditions are minimal: the plugin must be installed and active, and the victim must view the affected page. No patch is currently available.
Affected products
- BlueEye BE REST Endpoints through 1.0.0
Timeline
- 2026-09-10: disclosed
- 2026-09-12: advisory