CVE-2026-2280

Vulnerability

The rexCrawler plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) through its admin settings in all versions up to and including 1.0.15. The vulnerability exists because user-supplied input, such as group titles and descriptions, is echoed without proper output escaping in admin_main.php [1]. This affects multi-site installations and installations where the unfiltered_html capability has been disabled.

Exploitation

An authenticated attacker with administrator-level permissions can inject arbitrary web scripts by crafting malicious input in the plugin's admin settings (e.g., group creation or editing). The stored script executes whenever a user accesses the affected admin page. The attack is only exploitable on multi-site setups or environments where unfiltered_html is disabled.

Impact

Successful exploitation allows the attacker to execute arbitrary web scripts in the context of the admin dashboard. This can lead to session hijacking, defacement, theft of sensitive data, or further privilege escalation within the WordPress installation.

Mitigation

As of the publication date (2026-05-27), no patched version has been released. Possible mitigations include restricting administrator access to trusted users, disabling the plugin on non-multi-site installations, or removing the plugin entirely. If the plugin is no longer maintained, a complete removal is recommended.