EUVD-2026-31034
GHSA-9hmw-83v5-qm22
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
The 診断ジェネレータ作成プラグイン (Diagnosis Generator) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'js' parameter in versions up to and including 1.4.16. This is due to missing authorization checks and insufficient input sanitization in the themeFunc() function. The function is hooked to 'admin_init' and processes theme update requests without verifying user capabilities, allowing any authenticated user (including subscribers) to save malicious JavaScript to theme files. Additionally, the save() function uses stripslashes() which removes WordPress's magic quotes protection. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in theme files that will execute whenever a user accesses a page containing the diagnosis form shortcode.
AnalysisAI
Stored Cross-Site Scripting in the Diagnosis Generator (診断ジェネレータ作成プラグイン) WordPress plugin allows any subscriber-level authenticated user to write arbitrary JavaScript into WordPress theme files by exploiting a missing capability check in themeFunc(). The payload persists in theme files and executes in every site visitor's browser upon loading any page containing the diagnosis form shortcode, giving a single low-privilege attacker persistent, cross-user script execution. No public exploit has been identified at time of analysis, but the subscriber-level access requirement makes this a broad risk on any WordPress site with open user registration.
Technical ContextAI
The vulnerability resides in themeClass.php (lines 26 and 39) and diagnosisAdminClass.php (line 409) of the os-diagnosis-generator WordPress plugin by olivesystem (CPE: cpe:2.3:a:olivesystem:診断ジェネレータ作成プラグイン). The themeFunc() method is registered as a WordPress admin_init hook, which fires for any authenticated request to the admin area - including requests from subscriber-level users who have no legitimate administrative capability. The function processes theme update requests and writes the attacker-controlled 'js' parameter value to theme files without invoking current_user_can() or verifying a nonce. The save() function compounds the flaw by calling stripslashes() on input, deliberately removing WordPress's built-in magic quotes escaping, which would otherwise neutralize injected quote characters. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause class: unsanitized user input is written to a server-side file and subsequently served as executable JavaScript to all visitors who load a page containing the [diagnosis form] shortcode, as confirmed by the vulnerable rendering path at include_files/user-viewFormPage.php line 102.
RemediationAI
No vendor-released patch has been identified at time of analysis - the WordPress Plugin SVN trunk and 1.4.16 tag both appear to contain the vulnerable code, and no fixed release version is referenced in any available advisory. The primary recommended action is to deactivate and remove the Diagnosis Generator plugin immediately until a patched version is confirmed available. Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/c5293c0f-90b0-41df-a623-90297d998c41 for patch release notification. If the plugin cannot be removed, disable open user registration (WordPress Settings > General > uncheck 'Anyone can register') and audit all existing subscriber-level accounts to reduce the pool of potential attackers - note this does not eliminate risk if any legitimate subscriber account is compromised. Deploying a WAF rule to block POST requests containing JavaScript constructs (script tags, event handlers, javascript: URIs) in the 'js' parameter targeting wp-admin endpoints provides partial mitigation but can be bypassed by encoding variations. Conduct a forensic review of active theme files for unexpected JavaScript content to detect prior exploitation.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' paramete
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today