CVE-2026-1903

Vulnerability

Analysis

The Ravelry Designs Widget plugin for WordPress (versions ≤ 1.0.0) suffers from a Stored Cross-Site Scripting (XSS) vulnerability. The bug resides in the sb_ravelry_designs shortcode, where the layout attribute is not properly sanitized or escaped. User-supplied attributes are passed directly into output without validation, allowing malicious HTML/JavaScript to be stored and later executed [1].

Exploitation

Prerequisites

An attacker must have at least Contributor-level access to a WordPress site (i.e., an authenticated user with the edit_posts capability). No further privileges or special network access are required. The attacker injects malicious script code through the shortcode's layout parameter when creating or editing a post or page containing the shortcode [1].

Impact

Once the payload is stored, it executes in the browser of any user who visits the compromised page. This can lead to session hijacking, defacement, redirection to malicious sites, or theft of sensitive data such as cookies and authentication tokens. The attack does not require the victim to have any special role [1].

Mitigation

As of publication, the plugin is unmaintained and no patch has been released. Users are advised to remove the plugin and replace it with an alternative. Since the affected page is a plugin shortcode, disabling or deleting the plugin eliminates the vulnerable surface [1].