DoFollow Case by Case <= 3.6.0 - Unauthenticated Stored Cross-Site Scripting via Comment Link Attributes
- ID
- WPSEC-2026-0116
- Plugin
- DoFollow Case by Case (dofollow-case-by-case)
- Affected
- from 3.6.0 before 3.6.1
- Remediation
- Update to 3.6.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- DoFollow Case by Case on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-95817, on 2026-10-01.
Description
The DoFollow Case by Case plugin for WordPress is vulnerable to Stored Cross-Site Scripting via link attributes in comments in version 3.6.0 due to the plugin rewriting the rel attribute of comment links with a regular expression on the raw opening tag after WordPress sanitization. A crafted attribute value (such as a link title containing "rel=") could be mistaken for the real rel attribute, and the rewrite then broke attribute quoting and introduced executable attributes into the rendered comment. This makes it possible for unauthenticated attackers who can post comments to inject arbitrary web scripts in pages that will execute whenever a user accesses a page displaying the comment, including administrators viewing pending comments in the dashboard.
References
- https://wpsec.com/vuln/WPSEC-2026-0116/
- https://plugins.svn.wordpress.org/dofollow-case-by-case/tags/3.6.1/
- https://wordpress.org/plugins/dofollow-case-by-case/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS