CVE-2026-9626

Name of the Vulnerable Software and Affected Versions JSON API User versions prior to 4.1.1

Description The JSON API User plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the post comment() function fails to properly sanitize input, allowing the comment content value to be passed directly to wp insert comment() without HTML sanitization. Additionally, the vulnerability allows callers to set comment approved=1 to bypass moderation and self-approve comments. Authenticated attackers with subscriber-level access or higher can exploit the 'content' parameter of the 'post comment' API endpoint to inject arbitrary web scripts that execute when a user views the affected page.

Recommendations Update the plugin to a version newer than 4.1.0. As a temporary mitigation, restrict access to the 'post comment' API endpoint or avoid using the content parameter until the update is applied.