Executive brief
The KeepInMind - Dashboard Notes plugin for WordPress, which allows users to create and display notes on the administrative dashboard, contains a security flaw. This vulnerability allows a low-privileged user, such as a contributor, to inject malicious code into a note. When an administrator views the dashboard, this code can take over their account by displaying a fake login screen to steal credentials or by completely blocking access to the site's management interface.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in the KeepInMind - Dashboard Notes plugin (versions prior to 0.8.4.2) due to insufficient sanitization of the 'content' parameter in the REST API endpoint `/wp-json/haayal/v1/notes`. While the plugin uses `wp_kses()`, it fails to restrict dangerous CSS properties within the 'style' attribute, such as 'position: fixed' and 'z-index'. An authenticated attacker with Contributor-level privileges can inject a malicious payload that, when viewed by an Administrator, executes a UI redressing attack. This can be used to overlay a fake login prompt to harvest administrative credentials or create a persistent Denial of Service (DoS) by blocking the dashboard interface. The issue is fixed in version 0.8.4.2.
Affected products
- haayal KeepInMind – Dashboard Notes < 0.8.4.2
Timeline
- 2026-04-26: disclosed: Vulnerability reported to WordPress.org Plugins Team.
- 2026-06-12: advisory: WPScan and NVD published the vulnerability details.
- 2026-06-12: patched: Version 0.8.4.2 released to address the issue.