LifePress Plugin XSS: Unauthenticated Attackers Inject Malicious Scripts
The National Vulnerability Database has disclosed CVE-2026-6690, a high-severity (CVSS 7.2) stored Cross-Site Scripting (XSS) vulnerability affecting the LifePress plugin for WordPress, specifically in all versions up to and including 2.2.2. This flaw resides in the lp_update_mds AJAX action, which lacks critical nonce verification and capability checks.
Attackers can exploit insufficient input sanitization and output escaping when the series name is rendered on the admin settings page. This permits unauthenticated attackers to inject arbitrary web scripts. These scripts execute whenever a user, particularly an administrator, accesses an injected page, leading to potential session hijacking, data theft, or further compromise of the WordPress site.
This is a classic authentication bypass combined with poor input handling. The absence of proper security checks on an AJAX endpoint is a glaring oversight, creating a wide-open vector for client-side attacks. Defenders need to understand that such vulnerabilities are low-hanging fruit for opportunistic attackers.
What This Means For You
- If your organization uses the LifePress plugin for WordPress, you are exposed to unauthenticated stored XSS. Immediately identify all instances of the plugin and update to a patched version once available. If an update isn't available, disable or remove the plugin. Audit your WordPress sites for any signs of script injection, especially in administrative settings related to the LifePress plugin.
Related ATT&CK Techniques
🛡️ Detection Rules
2 rules · 6 SIEM formats2 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
WordPress LifePress Plugin Stored XSS via lp_update_mds AJAX Action - CVE-2026-6690
title: WordPress LifePress Plugin Stored XSS via lp_update_mds AJAX Action - CVE-2026-6690
id: scw-2026-05-12-ai-1
status: experimental
level: high
description: |
Detects attempts to exploit CVE-2026-6690 by targeting the lp_update_mds AJAX action in the LifePress WordPress plugin. This rule looks for requests to 'admin-ajax.php' with the 'action=lp_update_mds' parameter and the presence of an 'n=' parameter containing script tags, indicating a potential Stored Cross-Site Scripting (XSS) payload injection.
author: SCW Feed Engine (AI-generated)
date: 2026-05-12
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-6690/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri|contains:
- '/wp-admin/admin-ajax.php'
cs-uri-query|contains:
- 'action=lp_update_mds'
cs-uri-query|contains:
- 'n='
selection_indicators:
cs-uri-query|contains:
- '<script>'
condition: selection AND selection_indicators
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-6690 | XSS | LifePress plugin for WordPress versions <= 2.2.2 |
| CVE-2026-6690 | XSS | Vulnerable AJAX action: lp_update_mds (parameter 'n') |
| CVE-2026-6690 | Auth Bypass | Missing nonce verification and capability checks for wp_ajax_nopriv_lp_update_mds |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 12, 2026 at 12:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-45218: WP Travel Blind SQL Injection Puts User Data at Risk
CVE-2026-45218 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel WP Travel wp-travel allows Blind SQL Injection.This...
CVE-2026-45215 — Saad Iqbal WP EasyPay Wp-Easy-Pay Vulnerability
CVE-2026-45215 — Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal WP EasyPay wp-easy-pay allows Retrieve Embedded Sensitive Data.This issue affects WP EasyPay:...
Xpro Elementor Addons SQL Injection (CVE-2026-45214) Poses High Risk
CVE-2026-45214 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Blind SQL Injection.This...