PT-2026-47673 · WordPress · Extra Settings For Rocketchat

Nail Majdeddine · CVE-2026-8841 · Published 2026-06-09 · Updated 2026-06-18

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Extra Settings for RocketChat versions prior to 0.2

Description The Extra Settings for RocketChat plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the rxstg shortcode() function fails to properly sanitize input and escape output when processing the title attribute of the 'rocketchat' shortcode, concatenating it directly into the HTML output. Authenticated attackers with contributor-level access or higher can exploit this to inject arbitrary web scripts into pages, which then execute when accessed by other users.

Recommendations Update the plugin to a version later than 0.1. As a temporary workaround, restrict the use of the title attribute within the 'rocketchat' shortcode for users with contributor-level access.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-8841

Affected Products

Extra Settings For Rocketchat

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-8841 · Security Note
• https://plugins.trac.wordpress.org/browser/extra-settings-for-rocketchat/trunk/rocketchat-extra-settings.php#L350 · Note
• https://reddit.com/r/StopBadBots/comments/1u9fi90/critical_alert_unpatched_vulnerabilities_found · Reddit Post
• https://plugins.trac.wordpress.org/browser/extra-settings-for-rocketchat/trunk/rocketchat-extra-settings.php#L346 · Note
• https://reddit.com/r/sysadmin/comments/1u8m7z8/microsoft_announces_exciting_new_windows_features · Reddit Post
• https://wordfence.com/threat-intel/vulnerabilities/id/061eeba3-10ad-4272-9880-dc01d4368683?source=cve · Note
• https://t.me/CVEtracker/56250 · Telegram Post