CVE-2026-92967: Pochipp <= 1.20.2 - Reflected Cross-Site Scripting via 'keyword' Parameter
The Pochipp plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'keyword' parameter in versions up to, and including, 1.20.2. This is due to insufficient output escaping , which reads $GET['keyword'], applies only sanitizetextfield() (which strips tags but leaves double quotes intact) and interpolates the value directly into the value attribute of the search input via a PHP heredoc, without escattr(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user with uploadfiles capability (Author or above) into performing an action such as clicking on a specially crafted link to /wp-admin/media-upload.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/pochippto a version that resolves this vulnerability.Fixed in 1.20.2 - Compensating control
Restrict access to /wp-admin/media-upload so only trusted, necessary users (e.g., limit who can have the upload_files capability) can reach the vulnerable workflow.
Event History
Frequently Asked Questions
Who is exposed to this issue?
WordPress sites using the Pochipp plugin at version 1.20.2 or earlier are affected. Exploitation targets users who have the upload_files capability, such as Authors or higher-privileged users.
Does an attacker need an account or special access to exploit it?
No. An unauthenticated attacker can craft a malicious link containing the keyword parameter, but must persuade a user with upload_files capability to follow it.
What is the likely impact if exploitation succeeds?
The injected script executes in the context of the targeted user's WordPress session. It can affect confidentiality and integrity within the scope of that user's access.
How can I identify potentially affected installations?
Check whether Pochipp is installed and whether its version is 1.20.2 or earlier. The affected request path is /wp-admin/media-upload, where the keyword query parameter is reflected into a search-input value attribute.