Executive brief
The JSON API User plugin for WordPress, which allows external applications to interact with user data, contains a security flaw in its commenting feature. An attacker with a basic user account can post comments containing malicious scripts that bypass administrative approval and run automatically when other users view the page. This could allow an attacker to hijack user sessions or redirect visitors to malicious websites.
Technical details
The JSON API User plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization in the post_comment() function. The 'content' parameter is passed directly to the wp_insert_comment() function without HTML sanitization. Furthermore, the API allows callers to set 'comment_approved=1', enabling attackers to bypass the standard WordPress comment moderation queue. Authenticated attackers with subscriber-level permissions or higher can inject arbitrary web scripts into the database. These scripts execute in the browser of any user who visits the affected page. The issue is fixed in version 4.1.2.
Affected products
- parorrey JSON API User up to, and including, 4.1.0
Timeline
- 2026-07-03: disclosed
- 2026-07-03: advisory
References
- https://plugins.trac.wordpress.org/browser/json-api-user/tags/4.1.0/controllers/User.php
- https://plugins.trac.wordpress.org/browser/json-api-user/tags/4.1.0/controllers/User.php
- https://plugins.trac.wordpress.org/browser/json-api-user/tags/4.1.0/controllers/User.php
- https://plugins.trac.wordpress.org/changeset/3576431/json-api-user/trunk/controllers/User.php
- https://plugins.trac.wordpress.org/changeset?old_path=%2Fjson-api-user/tags/4.1.0&new_path=%2Fjson-api-user/tags/4.1.2
- https://www.wordfence.com/threat-intel/vulnerabilities/id/c41b0370-2881-4053-98b1-9c70251a3b63?source=cve