What is the CVSS score of CVE-2026-2432?

CVE-2026-2432 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-2432?

Organizations using CM Custom Reports - Flexible reporting to track what matters most should be aware of moderate risk from CVE-2026-2432, a cross-site scripting vulnerability rated CVSS 4.4.

How to fix or mitigate CVE-2026-2432?

Within 30 days: Identify affected systems running for WordPress is vulnerable to Stored Cross-Site Scripting v and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-2432

EUVD-2026-13637 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-20 Wordfence

WordPress XSS

4.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 20, 2026 - 08:45 euvd

EUVD-2026-13637

Analysis Generated

Mar 20, 2026 - 08:45 vuln.today

CVE Published

Mar 20, 2026 - 08:25 nvd

MEDIUM 4.4

DescriptionCVE.org

The CM Custom Reports - Flexible reporting to track what matters most plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

AnalysisAI

CM Custom Reports - Flexible reporting to track what matters most plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in admin settings that allows authenticated administrators to inject arbitrary web scripts. The vulnerability affects all versions up to and including 1.2.7 and is caused by insufficient input sanitization and output escaping in the GraphModule.php file. While the CVSS score of 4.4 is moderate, exploitation is restricted to high-privilege authenticated attackers on multi-site WordPress installations or where unfiltered_html has been disabled, making real-world exploitability dependent on specific WordPress configurations.

Technical ContextAI

The vulnerability exists in the CM Custom Reports plugin (CPE: cpe:2.3:a:creativemindssolutions:cm_custom_reports_–_flexible_reporting_to_track_what_matters_most:*:*:*:*:*:*:*:*) and is categorized as CWE-79 (Improper Neutralization of Input During Web Page Generation), which is the classic Stored XSS weakness. The root cause is located in backend/classes/modules/GraphModule.php at line 151, where user-controlled input from admin settings is stored without proper sanitization and subsequently rendered to the page without adequate HTML escaping. This allows an authenticated admin to inject JavaScript that persists in the database and executes in the context of any user's browser that accesses the affected administrative page, bypassing WordPress's standard security model that typically allows administrators to use unfiltered_html.

RemediationAI

Immediately upgrade the CM Custom Reports plugin to version 1.2.8 or later, which addresses the insufficient sanitization and output escaping in GraphModule.php. Administrators should apply the patch documented in the WordPress plugin repository changeset referenced at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3464005%40cm-custom-reports&new=3464005%40cm-custom-reports. Until patching can be completed, restrict administrative dashboard access using WordPress security plugins that implement additional authentication layers, disable the CM Custom Reports plugin functionality via wp-config.php constants if available, and audit admin user accounts for suspicious activity using security monitoring plugins. For multi-site installations, consider using security plugins that enforce additional output escaping on all admin pages as a defense-in-depth measure.