Executive brief
The Tuxquote plugin for WordPress, which is used to display formatted quotes on websites, contains a security flaw that allows users with basic posting privileges to inject malicious scripts into pages. When other visitors or administrators view the affected page, the hidden script executes in their browser, potentially leading to unauthorized actions or data theft. This risk is particularly high for sites that allow multiple contributors or guest authors to create content.
Technical details
The Tuxquote plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping in the tuxquote_build_format() function. Specifically, user-supplied attributes such as 'title', 'align', and 'width' within the [TUXQUOTE] shortcode are concatenated directly into the rendered HTML without being processed by security functions like esc_attr() or esc_html(). An authenticated attacker with Contributor-level permissions or higher can exploit this by crafting a shortcode containing malicious JavaScript. When the page is rendered, the script is stored and executed in the context of any user who views the post. The vulnerability exists in all versions up to and including 1.3.
Affected products
- Tuxquote Tuxquote Up to and including 1.3
Timeline
- 2026-05-27: disclosed: Vulnerability published to the CVE list.
- 2026-05-27: advisory: Wordfence published a vulnerability report.