EUVD-2026-24698Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Buzz Comments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Custom Buzz Avatar' (buzz_comments_avatar_image) setting in all versions up to, and including, 0.9.4. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the plugin settings page.
AnalysisAI
Stored cross-site scripting in the Buzz Comments WordPress plugin (all versions up to 0.9.4) allows authenticated administrators to inject arbitrary JavaScript via the 'Custom Buzz Avatar' setting, with the malicious script executing whenever any user accesses the plugin settings page. The vulnerability requires high-privilege administrative access and manual interaction with the settings interface, limiting its practical exploitability to insider threats or compromised administrator accounts.
Technical ContextAI
The Buzz Comments plugin is a WordPress plugin (CPE: cpe:2.3:a:mixer2:buzz_comments:*:*:*:*:*:*:*:*) that manages user comments and avatars. The vulnerability is a classic CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the 'buzz_comments_avatar_image' setting parameter. The plugin fails to sanitize user input when storing the custom avatar image URL and fails to properly escape output when rendering this value on the admin settings page (admin.tpl.php line 36 and buzzComments_class.php line 187). This allows an administrator to store malicious JavaScript payload in the database, which is then reflected and executed in the browser context of any user (including other administrators and site maintainers) who views the plugin settings page.
RemediationAI
Update the Buzz Comments plugin to a patched version beyond 0.9.4 as released by the plugin developer; exact patched version number not specified in provided references, so check the WordPress.org plugin page or Wordfence advisory for the latest stable release. The fix should include proper input sanitization of the 'buzz_comments_avatar_image' setting using WordPress sanitization functions (e.g., sanitize_text_field() or esc_url()) and output escaping using esc_url() or esc_attr() when rendering the avatar URL in admin.tpl.php. Until a patch is available, administrators should restrict access to the plugin settings page to trusted users only, audit any existing custom avatar settings for injected scripts, and consider temporarily disabling the custom avatar feature by removing or commenting out the relevant input field in admin.tpl.php. Additionally, implement WordPress security hardening such as strong passwords, two-factor authentication for administrator accounts, and regular security audits to reduce the risk of administrator account compromise.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today