PT-2026-4589 · WordPress · Allow Html In Category Descriptions

Zast.Ai · Published 2026-01-24 · Updated 2026-02-14 · CVE-2026-0693

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Allow HTML in Category Descriptions plugin for WordPress versions up to and including 1.2.4

Description The Allow HTML in Category Descriptions plugin for WordPress is susceptible to Stored Cross-Site Scripting through category descriptions. This occurs because the plugin removes the wp kses data output filter without verifying user capabilities for term description, link description, link notes, and user description fields. This allows authenticated attackers with administrator-level access or higher to inject arbitrary web scripts into category descriptions. These scripts will execute when a user accesses a page displaying the category description. This issue specifically impacts multi-site installations and those with unfiltered html disabled. The issue stems from a mismatch between input and output permissions, where input is authorized but output lacks proper safeguarding.

Recommendations Versions prior to and including 1.2.4 should be updated to a newer, fixed version when available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-0693

Affected Products

Allow Html In Category Descriptions

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-0693 · Security Note
• https://twitter.com/geng_zast/status/2014908450837577942 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2022711936249389111 · Twitter Post
• https://twitter.com/CVEnew/status/2022567895734325308 · Twitter Post
• https://twitter.com/geng_zast/status/2014907638908387530 · Twitter Post
• https://plugins.trac.wordpress.org/browser/allow-html-in-category-descriptions/trunk/html-in-category-descriptions.php#L23 · Note
• https://plugins.trac.wordpress.org/browser/allow-html-in-category-descriptions/tags/1.2.4/html-in-category-descriptions.php#L23 · Note
• https://twitter.com/zast_ai/status/2014903775681773660 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/b63c9a5a-fa3e-46c7-9d9c-7c209fc5713a?source=cve · Note