PatchSiren cyber security CVE debrief

CVE-2026-8707 nsthemes CVE debrief

The NS Product icon badge plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) via the PHP_SELF variable in all versions up to and including 1.2.4. The vulnerability stems from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts. Successful exploitation requires user interaction, such as tricking a victim into clicking a malicious link. The vulnerability was disclosed on 2026-05-27 with a CVSS 3.1 score of 6.1 (Medium severity). Multiple code locations in the plugin's options page file are implicated. No patch is currently available; users should disable the plugin pending an update.

Vendor: nsthemes
Product: NS Product icon badge
CVSS: MEDIUM 6.1
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-27
Original CVE updated: 2026-05-27
Advisory published: 2026-05-27
Advisory updated: 2026-05-27

Who should care

WordPress site administrators using the NS Product icon badge plugin; security teams managing WordPress estates; developers maintaining WordPress plugins with similar PHP_SELF usage patterns

Technical summary

The NS Product icon badge WordPress plugin (≤v1.2.4) fails to sanitize or escape the PHP_SELF superglobal before outputting it in HTML context within its administrative options page (ns_addNewOptionsPage.php). This classic reflected XSS pattern allows attackers to craft malicious URLs containing JavaScript payloads that execute in the victim's browser when the options page is accessed. The vulnerability affects lines 101, 123, 209, and 228 of the affected file. Attack complexity is low, but successful exploitation requires social engineering to induce target users (typically administrators) to visit the crafted URL. The vulnerability does not require authentication, broadening the attack surface.

Defensive priority

medium

Recommended defensive actions

Disable the NS Product icon badge plugin immediately on all WordPress installations pending security patch availability
Review web server access logs for suspicious requests targeting /wp-content/plugins/product-icon-badge/ paths with PHP_SELF manipulation attempts
Implement Content Security Policy (CSP) headers to mitigate XSS impact if plugin must remain temporarily active
Monitor WordPress plugin repository for version 1.2.5 or later security update
Conduct security review of other plugins by the same vendor for similar PHP_SELF XSS patterns

Evidence notes

Vulnerability confirmed via Wordfence security advisory and WordPress plugin repository source code review. CWE-79 (Improper Neutralization of Input During Web Page Generation) identified as primary weakness. CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Official resources

2026-05-27