Stored XSS in The Vigilant Security Plugin for WordPress

The Vigilant security plugin for WordPress, a suite providing firewall and login protection features, contains a vulnerability in all versions up to and including 2.10.2. The plugin fails to sufficiently sanitize and escape data from the User-Agent HTTP header before storing and displaying it within the application interface. This oversight allows unauthenticated attackers to conduct Stored Cross-Site Scripting (XSS) attacks. By crafting a malicious User-Agent header and triggering a failed login attempt, an attacker can cause the plugin to store an XSS payload in its database logs. When an administrator later views the logs or affected pages where the User-Agent is rendered, the payload executes in the context of the administrator's session. This flaw potentially allows unauthorized actions, privilege escalation, or session hijacking within the WordPress dashboard, making it a high-risk vector for site compromise.

Impact

Successful exploitation of CVE-2026-81754 leads to Stored XSS within the WordPress administration panel. If an administrator views the logs populated by this plugin, the attacker can execute arbitrary JavaScript. This impact includes the potential for creating new administrative accounts, modifying site settings, or exfiltrating sensitive session tokens. The vulnerability affects any WordPress installation utilizing the impacted plugin version.

Recommendation

Prioritize the immediate update of the 'The Vigilant' plugin to any version released after 2.10.2. In the absence of an available patch, disable the plugin's logging functionality or implement a Web Application Firewall (WAF) rule to block or strip common XSS patterns from the User-Agent HTTP header.

Rules

title: "Detect Stored XSS Attempt via User-Agent in WordPress" description: "Detects potential exploitation of CVE-2026-81754 - HTTP requests containing common XSS payloads within the User-Agent header directed at WordPress login or API endpoints." logsource: category: webserver detection: selection: cs-method: "POST" cs-uri-stem|contains:

• "/wp-login.php"
• "/wp-admin/admin-ajax.php" user-agent|contains:
• "<script"
• "javascript:"
• "onload="
• "onerror=" condition: selection level: high tags:
• attack.initial_access
• attack.t1190 falsepositives:
• "Legitimate security scanners or automated testing tools using anomalous User-Agent strings" tests: positive:
• name: "Failed login attempt with XSS payload in User-Agent" data:
• cs-method: "POST" cs-uri-stem: "/wp-login.php" user-agent: "Mozilla/5.0 <script>alert(1)</script>" negative:
• name: "Normal login attempt" data:
• cs-method: "POST" cs-uri-stem: "/wp-login.php" user-agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" handoff: detection_confidence: "high" required_telemetry:
• log_source: "Webserver access logs" event_or_channel: "HTTP request logs" required_fields:
• "cs-method"
• "cs-uri-stem"
• "user-agent" availability: "available" notes: "Requires logging of full HTTP request headers" validation: status: "needs_environment_validation" steps:
• "Send a safe, benign string in a custom User-Agent header to a staging instance to confirm logging visibility" expected_telemetry: "Web server log entry containing the custom User-Agent" pass_criteria: "Detection rule identifies the payload in the logs" suggested_owner: "Detection Engineering"