Executive brief
The Mutual Funds Data plugin for WordPress, which is used to display financial information on websites, contains a security flaw that allows users with basic contributor permissions to inject malicious scripts into pages. When other users or administrators visit these affected pages, the scripts will execute in their browsers. This could lead to unauthorized actions being performed on behalf of the victim or the theft of sensitive session information.
Technical details
The Mutual Funds Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping in the mfd_shortcode() function. Specifically, the 'title' attribute provided via a shortcode is concatenated directly into the HTML output within a <caption> element without being properly neutralized. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts. These scripts are stored on the server and execute in the context of any user who views the compromised page. The vulnerability affects all versions up to and including 1.2.1.
Affected products
- Mutual Funds Data Mutual Funds Data up to, and including, 1.2.1
Timeline
- 2026-05-27: disclosed: Initial publication of the CVE record.
- 2026-05-27: advisory: Wordfence published the vulnerability details.