CVE-2026-92967

Overview

The Pochipp plugin for WordPress up to version 1.20.2 contains a Reflected Cross-Site Scripting vulnerability in the 'keyword' parameter. The issue occurs because input is insufficiently escaped when rendered inside a search input attribute via PHP heredoc. This matters as it allows unauthenticated actors to execute arbitrary scripts in the context of privileged users.

Description

The Pochipp plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'keyword' parameter in versions up to, and including, 1.20.2. This is due to insufficient output escaping , which reads $_GET['keyword'], applies only sanitize_text_field() (which strips tags but leaves double quotes intact) and interpolates the value directly into the value attribute of the search input via a PHP heredoc, without esc_attr(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user with upload_files capability (Author or above) into performing an action such as clicking on a specially crafted link to /wp-admin/media-upload.

Impact

This vulnerability impacts the integrity and confidentiality of the WordPress site by enabling potential script execution within an administrative or author-level context. Authenticated users with 'upload_files' capability, such as Authors or above, are specifically targeted when tricked into interacting with a malicious link pointing to /wp-admin/media-upload. Compromise of these user sessions could lead to unauthorized actions or further administrative misuse.

Remediation

Update the Pochipp plugin to version 1.20.3 or later, once available from the vendor, which addresses the insufficient output escaping. Ensure developers use proper contextual escaping functions such as esc_attr() instead of relying solely on sanitization for output rendering. Implement strict security awareness training for privileged users regarding suspicious links.

Risk context

The vulnerability carries a CVSS v3 score of 6.1, designating it as a medium-severity issue. The current EPSS score is 0.00215, indicating a low immediate exploitation probability in the wild, though defenders should still prioritize applying vendor patches to prevent potential chaining attacks.

Affected products

• Pochipp plugin for WordPress