EUVD-2026-23179
GHSA-4xx2-h7jh-g7ph
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
The Custom New User Notification plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's admin settings in all versions up to, and including, 1.2.0. This is due to insufficient input sanitization and output escaping on multiple settings fields including 'User Mail Subject', 'User From Name', 'User From Email', 'Admin Mail Subject', 'Admin From Name', and 'Admin From Email'. The settings are registered via register_setting() without sanitize callbacks, and the values retrieved via get_option() are echoed directly into HTML input value attributes without esc_attr(). This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in the plugin settings page that will execute whenever a user accesses that page. This could be used in multi-site installations where administrators of subsites could target super administrators.
AnalysisAI
Stored Cross-Site Scripting (XSS) in Custom New User Notification plugin for WordPress versions up to 1.2.0 allows authenticated administrators to inject arbitrary JavaScript into plugin settings pages via unescaped admin form fields (User Mail Subject, User From Name, User From Email, Admin Mail Subject, Admin From Name, Admin From Email). When any user accesses the plugin settings page, the injected scripts execute in their browser context, enabling privilege escalation in WordPress multisite environments where subsite administrators target super administrators. No public exploit code or active exploitation has been identified; the attack requires Administrator-level credentials, limiting real-world risk despite moderate CVSS score.
Technical ContextAI
The vulnerability stems from insecure WordPress plugin development practices involving the Settings API. The Custom New User Notification plugin registers settings using WordPress's register_setting() function without applying sanitize callbacks-a fundamental control for input validation. When administrators configure the plugin, malicious script payloads embedded in form fields (like 'User Mail Subject') bypass sanitization during storage. On retrieval, the plugin uses get_option() to fetch these stored values and echoes them directly into HTML input value attributes without proper output escaping via esc_attr(). This pattern allows HTML/JavaScript breakout: an attacker can close the input element and inject script tags. CWE-79 (Improper Neutralization of Input During Web Page Generation) classifies this as a classic stored XSS flaw where untrusted data flows directly from storage to HTML rendering without sanitization or escaping at any step.
RemediationAI
Update the Custom New User Notification plugin to a version released after 1.2.0 that implements proper input sanitization via register_setting() sanitize callbacks and output escaping via esc_attr() on all affected form fields. If a patched version is not yet available, disable the plugin entirely until a fix is released, as stored XSS in admin settings cannot be reliably mitigated through access controls alone in multisite environments. As a temporary compensating control in single-site installations, restrict Administrator role membership to trusted personnel only and audit existing Administrator accounts for compromise. In multisite environments, closely review subsite administrator privileges and consider revoking delegated administration to subsite administrators until the plugin is patched, then grant it back only after verifying the updated version is installed. Monitor the WordPress Plugin Repository and Wordfence advisories for a patched release. No workaround exists that fully eliminates the risk without disabling the plugin or reverting to code-level fixes (manual input sanitization in the plugin file).
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' paramete
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today