CVE-2026-77820: WPComplete <= 2.9.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'empty' Shortcode Attribute
The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and including, 2.9.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the premium version of the software in order to exploit. Please note this only affects the pro version.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress WPComplete plugin (pro version)to a version that resolves this vulnerability.Fixed in 2.9.9.0
Event History
Frequently Asked Questions
Which deployments are affected?
Only the premium (Pro) version of WPComplete is affected. Versions up to and including 2.9.9.0 are vulnerable; the issue does not affect the non-Pro version.
What access does an attacker need?
An attacker must be authenticated to WordPress with Contributor-level permissions or higher. No victim interaction is needed for injection, but the injected script runs when someone accesses the affected page.
What is the practical impact of successful exploitation?
A permitted user can place arbitrary web scripts into a page through the shortcode's empty attribute. Those scripts execute in the browser of users who view that page, which can expose or alter content accessible in their browser context.
How can I identify potentially affected content?
Review pages created or edited by Contributor-level or higher users for WPComplete shortcodes using the empty attribute, particularly where the attribute contains unexpected markup or script-like content.