{
 "id": "WPSEC-2026-2518",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2518/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2518/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2518/index.md",
 "title": "Mathjax Latex <= 1.3.13 - Unauthenticated Stored Cross-Site Scripting via TeX \\href in Comments",
 "description": "The MathJax-LaTeX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via TeX markup in user-supplied content such as comments in all versions up to, and including, 1.3.13. The cause is that the plugin loads MathJax on the front end without its Safe extension, so TeX commands like \\href can create javascript: links. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when a user clicks the rendered link on a page where MathJax is loaded, for example a post using the plugin's shortcode or a site with the force-load setting enabled. Contributors without unfiltered_html can also exploit this through post content.",
 "plugin": {
  "slug": "mathjax-latex",
  "name": "Mathjax Latex",
  "full_name": "MathJax-LaTeX",
  "wordpress_org": "https://wordpress.org/plugins/mathjax-latex/",
  "advisories_url": "https://wpsec.com/vuln/plugin/mathjax-latex/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/mathjax-latex"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.4"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.4",
 "remediation": "Update to 1.4 or later.",
 "fix_released": "2026-11-03T17:44:40+00:00",
 "published": "2026-11-04T17:48:32+00:00",
 "updated": "2026-11-04T14:28:21.636080+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2518/",
  "https://plugins.svn.wordpress.org/mathjax-latex/tags/1.4/",
  "https://wordpress.org/plugins/mathjax-latex/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/mathjax-latex",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-04"
 }
}