Junglewise Threat Intelligence

CVE-2026-8624: WordPress LJ comments import: reloaded Reflected XSS via PHP_SELF

CVE-2026-8624 · Severity: medium · CVSS 6.1 · Published 2026-05-20

Vendors: Wordpress.

Executive brief

The LJ comments import: reloaded plugin for WordPress, which is used to import comments from LiveJournal, contains a security flaw that allows for reflected cross-site scripting. An attacker can trick a user into clicking a malicious link, allowing the attacker to run unauthorized scripts in the user's browser. This could lead to the theft of sensitive session information or unauthorized actions being performed on behalf of the user.

Technical details

The LJ comments import: reloaded plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the PHP_SELF server variable. The vulnerability exists because PHP_SELF includes attacker-controllable PATH_INFO appended to the script name, which is then echoed back to the page in two distinct locations within the same function. An unauthenticated attacker can exploit this by crafting a malicious URL and tricking a user into visiting it. Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's browser session. All versions up to and including 0.97.1 are affected.

Affected products

  • WordPress LJ comments import: reloaded All versions up to, and including, 0.97.1

Timeline

  • 2026-05-20: advisory: NVD publication date

References