CVE-2026-82823: WordPress Tangle Plugin Pre-Auth Reflected XSS Analysis

WordPress Loops & Logic – Reflected XSS Vulnerability Summary Vulnerability Overview Type: Reflected Cross-Site Scripting (Reflected XSS) Location: Root Cause: The parameter of and is output directly into the response without filtering or escaping, and can be triggered without authentication. Scope of Impact Affected Product: WordPress (via the Tangle plugin) CVSS v3 Base Score: 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) CVSS v4 Base Score: 6.9 Risk Level: Medium CVE ID: CVE-2026-82823 Tenable Advisory ID: TRA-2026-57 Disclosure Timeline: Initial contact on July 2, 2026; second and third attempts made on July 9 and July 16, respectively. Key Code (POC / Exploitation Related) 1. Unauthenticated Handler Registration (store.php lines 69-70 & 100-101) > The prefix makes both actions accessible to unauthenticated visitors. 2. Unfiltered Input (store.php line 73 & line 104) > The parameter is read directly from the request without validation or sanitization. 3. Injection Point / Sink (store.php lines 75-80 & 106-111) > If does not correspond to any registered field, any value enters this branch, and the raw value is interpolated into the error message. 4. Response Sending (store.php lines 132-143) > The response is served as (no JSON Content-Type header), causing browsers to parse tags like within as HTML and execute them, thereby triggering XSS. Remediation Current Status: No patch has been released as of this date. Recommended Mitigations: 1. Perform strict validation/sanitization on (e.g., whitelist validation of field names). 2. Correctly set the response header in to prevent browsers from parsing the response as HTML. 3. HTML-escape when outputting it in the error message (e.g., using ). 4. Consider removing the prefix to restrict invocation to authenticated users only. References Official reference link: https://wordpress.org/plugins/tangle-loops-and-logic/

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-82823: WordPress Tangle Plugin Pre-Auth Reflected XSS Analysis