Vulnerability · Published Feb 14, 2026 · Assigned by Wordfence
CVE-2026-0693Allow HTML in Category Descriptions <= 1.2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Category Descriptions
Medium 4.4
In plain English
A medium-severity cross-site scripting in Allow HTML in Category Descriptions from arnoesterhuizen. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).
Official description
The Allow HTML in Category Descriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via category descriptions in all versions up to, and including, 1.2.4. This is due to the plugin unconditionally removing the `wp_kses_data` output filter for term_description, link_description, link_notes, and user_description fields without checking user capabilities. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in category descriptions that will execute whenever a user accesses a page where the category description is displayed. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| arnoesterhuizen | Allow HTML in Category Descriptions | 0 – through 1.2.4 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/b63c9a5a-fa3e-46c7-9d9c-7c209fc5713a?source=cve
- https://plugins.trac.wordpress.org/browser/allow-html-in-category-descriptions/trunk/html-in-category-descriptions.php#L23
- https://plugins.trac.wordpress.org/browser/allow-html-in-category-descriptions/tags/1.2.4/html-in-category-descriptions.php#L23