Mathjax Latex <= 1.3.13 - Unauthenticated Stored Cross-Site Scripting via TeX \href in Comments
- ID
- WPSEC-2026-2518
- Plugin
- MathJax-LaTeX (mathjax-latex)
- Affected
- all versions before 1.4
- Remediation
- Update to 1.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-04
- Attack surface
- Mathjax Latex on WPSec AttackSurface
- Fix released
- Published
Description
The MathJax-LaTeX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via TeX markup in user-supplied content such as comments in all versions up to, and including, 1.3.13. The cause is that the plugin loads MathJax on the front end without its Safe extension, so TeX commands like \href can create javascript: links. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when a user clicks the rendered link on a page where MathJax is loaded, for example a post using the plugin's shortcode or a site with the force-load setting enabled. Contributors without unfiltered_html can also exploit this through post content.
References
- https://wpsec.com/vuln/WPSEC-2026-2518/
- https://plugins.svn.wordpress.org/mathjax-latex/tags/1.4/
- https://wordpress.org/plugins/mathjax-latex/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS