CVE-2026-9570: Taskbuilder < 5.0.8 - Reflected XSS via Shortcode

Synopsis

Reflected Cross-Site Scripting (XSS) affects the Taskbuilder WordPress plugin in versions before 5.0.8. The vulnerability is reachable over the network with no authentication required on the attacker's part, but it requires a logged-in user to visit a crafted URL. Successful exploitation lets an attacker execute arbitrary JavaScript in the victim's browser session, enabling session token theft, page content tampering, and limited disruption of the affected page. A patched-image rebuild at version 5.0.8 is available on HarborGuard for environments running an affected version of this plugin.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must deliver a crafted URL to a victim over the network, reaching any frontend page where a Taskbuilder shortcode is rendered.

• AuthenticationNot required

  No credentials are required on the attacker's side; the attacker constructs a malicious link that anyone can send.

• Victim interactionRequired

  A logged-in WordPress user must click or follow the attacker's crafted URL for the reflected payload to execute in their browser session.

• Attack complexityDetail

  The exploit is reliable and condition-free once the crafted URL is delivered; no race conditions or special environmental factors are needed.

Blast Radius

• Reads session cookies or authentication tokens belonging to the logged-in victim, enabling account takeover.
• Injects and executes arbitrary JavaScript in the victim's browser, allowing modification of visible page content.
• Can submit authenticated actions (form submissions, settings changes) silently on behalf of the victim within the same WordPress session.
• Causes limited disruption to the affected page's functionality as rendered in the victim's browser.