PatchSiren cyber security CVE debrief

CVE-2026-8624 etspring CVE debrief

A reflected cross-site scripting (XSS) vulnerability exists in the LJ comments import: reloaded WordPress plugin, affecting all versions up to and including 0.97.1. The vulnerability stems from insufficient input sanitization and output escaping of the PHP_SELF parameter, which includes attacker-controllable PATH_INFO appended to the script name. Two distinct unsanitized echo points for this value exist within the same function, enabling unauthenticated attackers to inject arbitrary web scripts. Successful exploitation requires user interaction, such as tricking a victim into clicking a malicious link. The vulnerability was disclosed on May 20, 2026, with a CVSS 3.1 score of 6.1 (Medium severity).

Vendor: etspring
Product: LJ comments import: reloaded
CVSS: MEDIUM 6.1
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-20
Original CVE updated: 2026-05-20
Advisory published: 2026-05-20
Advisory updated: 2026-05-20

Who should care

WordPress site administrators using the LJ comments import: reloaded plugin; security teams managing WordPress deployments; developers maintaining WordPress plugins that utilize PHP_SELF

Technical summary

The LJ comments import: reloaded WordPress plugin fails to sanitize the PHP_SELF superglobal before outputting it in HTML context. PHP_SELF incorporates the PATH_INFO component of the request URI, which is attacker-controllable. The plugin contains two separate echo statements of this unsanitized value within the same function, creating multiple injection points. An unauthenticated attacker can craft a URL with a malicious PATH_INFO segment containing JavaScript payloads; when a victim visits this URL, the script executes in their browser context. This is a classic reflected XSS pattern requiring social engineering for exploitation.

Defensive priority

medium

Recommended defensive actions

Update the LJ comments import: reloaded plugin to a version newer than 0.97.1 if available, or consider disabling the plugin until a patch is released
Implement Web Application Firewall (WAF) rules to filter malicious PATH_INFO payloads targeting PHP_SELF
Review and sanitize all uses of PHP_SELF in custom WordPress plugin code, using esc_url() or similar output escaping functions
Deploy Content Security Policy (CSP) headers to mitigate the impact of any successful XSS exploitation
Monitor WordPress admin access logs for suspicious requests containing script tags or encoded payloads in URL paths

Evidence notes

The vulnerability is documented in the WordPress plugin repository source code at lines 129 and 161 of lj_comments_import.php, where PHP_SELF is echoed without proper sanitization. Wordfence's threat intelligence provides additional technical analysis. The CVE record and NVD entry confirm the CVSS vector and CWE-79 classification.

Official resources

2026-05-20