WordPress Plugin Stored XSS via Unescaped Activity Log Input

The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high privilege users such as admin.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The 12 Step Meeting List WordPress plugin before version 3.19.17 contains a Stored Cross-Site Scripting (XSS) vulnerability that allows unauthenticated attackers to inject malicious scripts into the plugin's activity log. Because user input is neither sanitized nor escaped before storage and display, attackers can craft requests that plant persistent JavaScript payloads in the admin dashboard. This vulnerability is particularly dangerous because it targets high-privilege users like administrators who view the activity logs, potentially leading to account compromise, privilege escalation, or lateral movement within WordPress environments. Any website running the affected plugin version is vulnerable, regardless of WordPress hardening measures, making this a critical threat to the estimated thousands of sites using this plugin.

Casky's 323 mapped skills leverage Claude's extended reasoning to identify attack patterns associated with TA0001 (Initial Access) and TA0043 (Reconnaissance) techniques by analyzing how unauthenticated input flows through web applications. When practitioners run scans, they would observe detection of CWE-79 violations—specifically input validation failures where user-supplied data reaches output contexts without proper escaping. The platform would flag suspicious parameter patterns in HTTP requests targeting the plugin's logging functions, correlate unescaped output in admin pages, and highlight the threat chain: attacker submits malicious payload → plugin stores without sanitization → admin views logs and script executes in their session. Practitioners would see detailed findings showing the exact injection points, payloads detected, and recommended remediation focused on input validation, output encoding, and Content Security Policy implementation.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-78333.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-78333

Casky has 323 skills that investigate the attack patterns behind CVE-2026-78333. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn