{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/the-vigilant--100-free-security-suite-firewall-2fa-login-headers-scanner--2.10.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wordpress:the_vigilant_100_free_security_suite_firewall_2fa_login_headers_scanner:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-81754"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["The Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… (\u003c= 2.10.2)"],"_cs_severities":["high"],"_cs_tags":["xss","wordpress","cve-2026-81754"],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eThe Vigilant security plugin for WordPress, a suite providing firewall and login protection features, contains a vulnerability in all versions up to and including 2.10.2. The plugin fails to sufficiently sanitize and escape data from the User-Agent HTTP header before storing and displaying it within the application interface. This oversight allows unauthenticated attackers to conduct Stored Cross-Site Scripting (XSS) attacks. By crafting a malicious User-Agent header and triggering a failed login attempt, an attacker can cause the plugin to store an XSS payload in its database logs. When an administrator later views the logs or affected pages where the User-Agent is rendered, the payload executes in the context of the administrator's session. This flaw potentially allows unauthorized actions, privilege escalation, or session hijacking within the WordPress dashboard, making it a high-risk vector for site compromise.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-81754 leads to Stored XSS within the WordPress administration panel. If an administrator views the logs populated by this plugin, the attacker can execute arbitrary JavaScript. This impact includes the potential for creating new administrative accounts, modifying site settings, or exfiltrating sensitive session tokens. The vulnerability affects any WordPress installation utilizing the impacted plugin version.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the immediate update of the 'The Vigilant' plugin to any version released after 2.10.2. In the absence of an available patch, disable the plugin's logging functionality or implement a Web Application Firewall (WAF) rule to block or strip common XSS patterns from the User-Agent HTTP header.\u003c/p\u003e\n\u003ch2 id=\"rules\"\u003eRules\u003c/h2\u003e\n\u003cp\u003etitle: \u0026quot;Detect Stored XSS Attempt via User-Agent in WordPress\u0026quot;\ndescription: \u0026quot;Detects potential exploitation of CVE-2026-81754 - HTTP requests containing common XSS payloads within the User-Agent header directed at WordPress login or API endpoints.\u0026quot;\nlogsource:\ncategory: webserver\ndetection:\nselection:\ncs-method: \u0026quot;POST\u0026quot;\ncs-uri-stem|contains:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u0026quot;/wp-login.php\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u0026quot;/wp-admin/admin-ajax.php\u0026quot;\nuser-agent|contains:\u003c/li\u003e\n\u003cli\u003e\u0026quot;\u0026lt;script\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u0026quot;javascript:\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u0026quot;onload=\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u0026quot;onerror=\u0026quot;\ncondition: selection\nlevel: high\ntags:\u003c/li\u003e\n\u003cli\u003eattack.initial_access\u003c/li\u003e\n\u003cli\u003eattack.t1190\nfalsepositives:\u003c/li\u003e\n\u003cli\u003e\u0026quot;Legitimate security scanners or automated testing tools using anomalous User-Agent strings\u0026quot;\ntests:\npositive:\u003c/li\u003e\n\u003cli\u003ename: \u0026quot;Failed login attempt with XSS payload in User-Agent\u0026quot;\ndata:\u003c/li\u003e\n\u003cli\u003ecs-method: \u0026quot;POST\u0026quot;\ncs-uri-stem: \u0026quot;/wp-login.php\u0026quot;\nuser-agent: \u0026quot;Mozilla/5.0 \u0026lt;script\u0026gt;alert(1)\u0026lt;/script\u0026gt;\u0026quot;\nnegative:\u003c/li\u003e\n\u003cli\u003ename: \u0026quot;Normal login attempt\u0026quot;\ndata:\u003c/li\u003e\n\u003cli\u003ecs-method: \u0026quot;POST\u0026quot;\ncs-uri-stem: \u0026quot;/wp-login.php\u0026quot;\nuser-agent: \u0026quot;Mozilla/5.0 (Windows NT 10.0; Win64; x64)\u0026quot;\nhandoff:\ndetection_confidence: \u0026quot;high\u0026quot;\nrequired_telemetry:\u003c/li\u003e\n\u003cli\u003elog_source: \u0026quot;Webserver access logs\u0026quot;\nevent_or_channel: \u0026quot;HTTP request logs\u0026quot;\nrequired_fields:\u003c/li\u003e\n\u003cli\u003e\u0026quot;cs-method\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u0026quot;cs-uri-stem\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u0026quot;user-agent\u0026quot;\navailability: \u0026quot;available\u0026quot;\nnotes: \u0026quot;Requires logging of full HTTP request headers\u0026quot;\nvalidation:\nstatus: \u0026quot;needs_environment_validation\u0026quot;\nsteps:\u003c/li\u003e\n\u003cli\u003e\u0026quot;Send a safe, benign string in a custom User-Agent header to a staging instance to confirm logging visibility\u0026quot;\nexpected_telemetry: \u0026quot;Web server log entry containing the custom User-Agent\u0026quot;\npass_criteria: \u0026quot;Detection rule identifies the payload in the logs\u0026quot;\nsuggested_owner: \u0026quot;Detection Engineering\u0026quot;\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-11T05:12:16Z","date_published":"2026-09-11T05:12:16Z","id":"https://feed.craftedsignal.io/briefs/2026-09-cve-2026-81754/","summary":"The Vigilant security plugin for WordPress version 2.10.2 and earlier is vulnerable to Stored Cross-Site Scripting via the User-Agent header, allowing unauthenticated attackers to execute arbitrary scripts in the dashboard.","title":"Stored XSS in The Vigilant Security Plugin for WordPress","url":"https://feed.craftedsignal.io/briefs/2026-09-cve-2026-81754/"}],"language":"en","title":"CraftedSignal Threat Feed - The Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… (\u003c= 2.10.2)","version":"https://jsonfeed.org/version/1.1"}