EUVD-2026-38655
GHSA-p4m8-3gv5-584p
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered CSRF requires no attacker privileges (PR:N) but mandates admin interaction (UI:R); scope change (S:C) reflects stored XSS executing in victim browsers beyond the vulnerable WordPress instance.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Osiris Signature Banner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
AnalysisAI
Cross-Site Request Forgery in the Osiris Signature Banner WordPress plugin (all versions ≤ 0.5) enables unauthenticated attackers to update plugin settings and inject stored XSS payloads by tricking an authenticated administrator into triggering a forged request. Missing nonce validation across at least four functions (lines 107, 118, 139, and 189 of osiris-signature-banner.php) means any forged cross-origin form submission executed in an active admin session bypasses all server-side origin checks. No public exploit identified at time of analysis and no KEV listing is present, but the stored XSS secondary impact elevates real-world risk above a typical CSRF-only finding.
Technical ContextAI
The affected product is the Osiris Signature Banner WordPress plugin by vendor osiris8 (CPE: cpe:2.3:a:osiris8:osiris_signature_banner:*:*:*:*:*:*:*:*), all releases through version 0.5. The root cause is CWE-352 (Cross-Site Request Forgery), arising from absent or incorrect nonce validation. WordPress's security model requires plugins to call wp_verify_nonce() or check_admin_referer() on any state-changing request handler; without this, the browser's ambient session cookie satisfies authentication while the server cannot distinguish legitimate admin actions from forged ones. Wordfence source references identify the vulnerable code at four distinct locations in osiris-signature-banner.php (lines 107, 118, 139, and 189), indicating multiple settings-update and content-injection handlers share this defect. Because the plugin appears to write attacker-controlled content to WordPress storage, successful CSRF exploitation cascades into stored XSS, which accounts for the CVSS scope change (S:C).
RemediationAI
No vendor-released patch has been identified at time of analysis - the available references document version 0.5 as the current tagged release with no fixed version present in CPE data or references. The immediate recommended action is to deactivate and remove the Osiris Signature Banner plugin from all WordPress installations until a patched release is confirmed. As a compensating control, restricting WordPress admin dashboard access to known trusted IP ranges via server-level rules (e.g., nginx allow/deny directives or WAF IP allowlisting) reduces exposure to the social-engineering prerequisite, though this does not remediate the underlying flaw and may impact legitimate remote administration. Wordfence firewall customers may receive partial rule-based protection; consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/03226722-000c-4bfe-a09b-e75882274845 for rule availability. Monitor the WordPress plugin repository for an updated release and verify that the fix introduces proper nonce validation via wp_verify_nonce() or check_admin_referer() on all affected handlers.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today