# Mathjax Latex <= 1.3.13 - Unauthenticated Stored Cross-Site Scripting via TeX \href in Comments

- **ID:** WPSEC-2026-2518
- **Plugin:** MathJax-LaTeX (`mathjax-latex`), https://wordpress.org/plugins/mathjax-latex/
- **Affected versions:** all versions before 1.4
- **Fixed in:** 1.4 (Update to 1.4 or later.)
- **Severity:** Medium 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/mathjax-latex
- **Fix released:** 2026-11-03
- **Published:** 2026-11-04
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2518/

## Description

The MathJax-LaTeX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via TeX markup in user-supplied content such as comments in all versions up to, and including, 1.3.13. The cause is that the plugin loads MathJax on the front end without its Safe extension, so TeX commands like \href can create javascript: links. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when a user clicks the rendered link on a page where MathJax is loaded, for example a post using the plugin's shortcode or a site with the force-load setting enabled. Contributors without unfiltered_html can also exploit this through post content.

## References

- https://wpsec.com/vuln/WPSEC-2026-2518/
- https://plugins.svn.wordpress.org/mathjax-latex/tags/1.4/
- https://wordpress.org/plugins/mathjax-latex/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2518/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.