CVE-2026-6551 — Cross-Site Scripting (XSS)

title: WordPress Timeline Blocks Stored XSS via titleTag attribute — CVE-2026-6551
id: scw-2026-04-28-ai-1
status: experimental
level: medium
description: |
  Detects potential exploitation of CVE-2026-6551 by looking for POST requests to the WordPress post editing endpoint containing the 'titleTag' parameter with embedded script tags. This indicates an attempt to inject arbitrary JavaScript into the timeline block's title, which is stored and executed when other users view the page.
author: SCW Feed Engine (AI-generated)
date: 2026-04-28
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-6551/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/wp-admin/post.php'
      cs-uri-query|contains:
          - 'titleTag='
      cs-uri-query|contains:
          - '<script>'
      cs-uri-query|contains:
          - '</script>'
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse