CWE-79

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100193",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T17:50:59.542513Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T17:51:08.905Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Tutor LMS \u2013 eLearning and online course solution",
          "vendor": "themeum",
          "versions": [
            {
              "lessThanOrEqual": "4.1.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kuba"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Tutor LMS \u2013 eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u0027tab\u0027 parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the targeted lesson page to have an empty nav-items array \u2014 a condition that occurs naturally when a lesson has no post content, no attachments, and comments are disabled or the viewer is not logged in \u2014 which bypasses the in_array() tab validation and allows the raw attacker-controlled value to reach the sink."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T03:40:00.264Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4322fce1-0403-4458-82e3-7d374ab724c9?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.9/templates/learning-area/lesson/content.php#L56"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.9/templates/learning-area/lesson/content.php#L27"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.9/classes/Lesson.php#L1018"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3730615/tutor/trunk/templates/learning-area/lesson/content.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-25T14:40:55.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-13T15:13:16.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Tutor LMS \u003c= 4.1.0 - Reflected Cross-Site Scripting via \u0027tab\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-100193",
    "datePublished": "2026-10-14T03:40:00.264Z",
    "dateReserved": "2026-09-25T14:25:51.212Z",
    "dateUpdated": "2026-10-14T17:51:08.905Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100190",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-25T16:13:08.012327Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-25T16:13:26.973Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "crawler/crawler_splash"
          ],
          "product": "ail framework",
          "programFiles": [
            "var/www/templates/crawler/crawler_splash/showDomain.html"
          ],
          "repo": "https://github.com/ail-project/ail-framework",
          "vendor": "ail project",
          "versions": [
            {
              "lessThan": "7.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Aurelien Thirion"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Jeroen Pinoy"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe AIL Framework crawler splash domain page (showDomain.html) is vulnerable to stored cross-site script injection (XSS). User-supplied data originating from imported crawler captures\u2014specifically item IDs, URLs, and screenshot file paths\u2014was interpolated directly into inline JavaScript contexts within the HTML template. This included an onclick attribute that embedded raw screenshot and URL values into a JavaScript function call, and an inline script block that assigned a screenshot value to a JavaScript variable without escaping. An attacker with a user-role API client could craft a malicious crawler capture import containing JavaScript payloads in these fields. When any user (including privileged users) subsequently viewed the affected domain page, the injected script would execute in the victim\u0027s browser context, potentially allowing session hijacking, data exfiltration, or unauthorized actions on behalf of the victim. The vulnerability is stored in the application\u0027s data layer and triggered upon page rendering, requiring no further interaction beyond loading the domain view.\u003c/p\u003e"
            }
          ],
          "value": "The AIL Framework crawler splash domain page (showDomain.html) is vulnerable to stored cross-site script injection (XSS). User-supplied data originating from imported crawler captures\u2014specifically item IDs, URLs, and screenshot file paths\u2014was interpolated directly into inline JavaScript contexts within the HTML template. This included an onclick attribute that embedded raw screenshot and URL values into a JavaScript function call, and an inline script block that assigned a screenshot value to a JavaScript variable without escaping. An attacker with a user-role API client could craft a malicious crawler capture import containing JavaScript payloads in these fields. When any user (including privileged users) subsequently viewed the affected domain page, the injected script would execute in the victim\u0027s browser context, potentially allowing session hijacking, data exfiltration, or unauthorized actions on behalf of the victim. The vulnerability is stored in the application\u0027s data layer and triggered upon page rendering, requiring no further interaction beyond loading the domain view."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Cross Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input in Web Page (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T13:52:19.648Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ail-project/ail-framework/commit/31376ee3d04519c898bb9b3671453a41c4117340"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix removes all capture-derived values (item IDs, URLs, screenshot paths) from inline JavaScript contexts (onclick attributes and inline script variable assignments). These values are now stored in HTML data attributes (data-screenshot, data-url, data-item-id), which are properly HTML-escaped by the Jinja2 template engine. Screenshot click handlers are bound programmatically via addEventListener on elements with a .reload-image class, and the reload_image function reads values from the DOM element\u0027s dataset rather than receiving raw string parameters. Additionally, item IDs are URL-encoded with encodeURIComponent before being appended to link hrefs, preventing injection through the ID field.\u003c/p\u003e"
            }
          ],
          "value": "The fix removes all capture-derived values (item IDs, URLs, screenshot paths) from inline JavaScript contexts (onclick attributes and inline script variable assignments). These values are now stored in HTML data attributes (data-screenshot, data-url, data-item-id), which are properly HTML-escaped by the Jinja2 template engine. Screenshot click handlers are bound programmatically via addEventListener on elements with a .reload-image class, and the reload_image function reads values from the DOM element\u0027s dataset rather than receiving raw string parameters. Additionally, item IDs are URL-encoded with encodeURIComponent before being appended to link hrefs, preventing injection through the ID field."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Stored Cross-Site Scripting (XSS) via Crawler Capture Import in AIL Framework showDomain Page",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The UI:P (Passive) rating assumes the inline script vector (screenshot variable assignment) executes on page load without requiring a user click. The onclick vector would require UI:A, but the inline script vector is sufficient for exploitation.",
                  "PR:L assumes the attacker needs a user-role API client to import a crafted crawler capture, as stated in the commit message. The exact privilege level and authentication mechanism are not further specified in the patch.",
                  "The version boundary \u0027less_than 7.1\u0027 is inferred from the tag_version_boundary metadata showing 21 commits after the fix before the v7.1 tag, suggesting the fix is included in v7.1. Exact affected version ranges are not confirmed.",
                  "CAPEC-1 is selected as the closest available attack pattern for stored XSS; no more specific CAPEC for stored XSS via data import exists in the catalog.",
                  "The patch does not include test cases or additional context about whether other template files have similar inline JavaScript interpolation patterns; this advisory covers only the single file in the patch."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-1",
                    "rationale": "The patch directly remediates a stored XSS vector where attacker-controlled data from a crawler capture import is reflected into inline JavaScript without neutralization. CAPEC-1 is the canonical attack pattern for XSS. The specific sub-variant is stored (persistent) XSS via a data import mechanism, but CAPEC-1 is the closest and most appropriate mapping available in the CAPEC catalog."
                  }
                ],
                "commit": "31376ee3d04519c898bb9b3671453a41c4117340",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "terrtia"
                  }
                ],
                "cvssRationale": "AV:N: Exploitable over the network via the web application. AC:L: No special race conditions or complex setup; a crafted capture import suffices. AT:N: No manipulation of the attack target required. PR:L: Requires a user-role API client to import a malicious crawler capture (authenticated, low privilege). UI:P: The stored XSS in the inline script block executes passively when the victim loads the domain page; no click or active interaction is needed for the inline script vector. VC:N/VI:N/VA:N: The vulnerable component (server-side application) is not directly compromised in confidentiality, integrity, or availability. SC:H: Scope changes to the victim\u0027s browser session, enabling theft of session tokens, cookies, and sensitive data. SI:H: Scope integrity is impacted as the attacker can perform arbitrary actions in the victim\u0027s authenticated session. SA:N: No meaningful impact on the availability of the attacker\u0027s scope.",
                "fixSummary": "The fix removes all capture-derived values (item IDs, URLs, screenshot paths) from inline JavaScript contexts (onclick attributes and inline script variable assignments). These values are now stored in HTML data attributes (data-screenshot, data-url, data-item-id), which are properly HTML-escaped by the Jinja2 template engine. Screenshot click handlers are bound programmatically via addEventListener on elements with a .reload-image class, and the reload_image function reads values from the DOM element\u0027s dataset rather than receiving raw string parameters. Additionally, item IDs are URL-encoded with encodeURIComponent before being appended to link hrefs, preventing injection through the ID field.",
                "generatedAt": "2026-09-25T13:45:46.199650Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "c110d16dd8eee489472853615089aeb6b6e034457dcbaec9b038bf85ad96b920",
                "patchSummary": "In showDomain.html: (1) Replaced inline onclick=\"reload_image(\u0027...\u0027)\" with a data-attribute-based approach using data-screenshot, data-url, and data-item-id attributes on the table cell element, plus a .reload-image CSS class. (2) Removed the inline script block that assigned screenshot, URL, and ID values directly into JavaScript variables via Jinja2 interpolation; replaced with dataset reads from the domain_screenshot img element. (3) Changed reload_image() to accept a DOM element and read values from element.dataset instead of raw string arguments. (4) Added a programmatic event binding loop using document.querySelectorAll(\u0027.reload-image\u0027).forEach() with addEventListener(\u0027click\u0027). (5) Applied encodeURIComponent() to item IDs when constructing screenshot link hrefs. (6) Changed the href URL construction to use url_for with keyword arguments instead of string interpolation.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "31376ee3d04519c898bb9b3671453a41c4117340",
                    "patchSha256": "c110d16dd8eee489472853615089aeb6b6e034457dcbaec9b038bf85ad96b920",
                    "source": "https://github.com/ail-project/ail-framework/commit/31376ee3d04519c898bb9b3671453a41c4117340.patch",
                    "sourceUrl": "https://github.com/ail-project/ail-framework/commit/31376ee3d04519c898bb9b3671453a41c4117340.patch",
                    "subject": "chg: [security] prevent stored XSS through imported capture"
                  }
                ],
                "source": "https://github.com/ail-project/ail-framework/commit/31376ee3d04519c898bb9b3671453a41c4117340.patch",
                "subject": "chg: [security] prevent stored XSS through imported capture",
                "tagVersionBoundary": {
                  "commits_after_fix": 21,
                  "repository": "https://github.com/ail-project/ail-framework",
                  "tag": "v7.1",
                  "version": "7.1",
                  "version_type": "custom"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-79",
                    "rationale": "The patch explicitly addresses stored XSS by removing user-controlled values (screenshot paths, URLs, item IDs from crawler capture imports) from inline JavaScript contexts and replacing them with properly escaped data attributes and programmatic event binding. The commit message confirms the intent: \u0027prevent stored XSS through imported capture metadata in showDomain.\u0027"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20292"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-100190",
    "datePublished": "2026-09-25T13:52:19.648Z",
    "dateReserved": "2026-09-25T13:52:13.769Z",
    "dateUpdated": "2026-09-25T16:13:26.973Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100186",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T14:34:13.376733Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T14:39:03.586Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles \u0026 User Role Editor",
          "vendor": "cozmoslabs",
          "versions": [
            {
              "lessThanOrEqual": "4.0.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "whale120"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles \u0026 User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via First Name Field in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the Email Confirmation feature is enabled in Profile Builder."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T05:30:28.153Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f3f2ecdb-bbd0-4834-b731-88724ca0dfd7?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/features/email-confirmation/class-email-confirmation.php#L99"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/features/email-confirmation/class-email-confirmation.php#L100"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/front-end/default-fields/first-name/first-name.php#L56"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.3/features/email-confirmation/email-confirmation.php#L470"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3741133/profile-builder"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3741133/profile-builder/trunk/features/email-confirmation/class-email-confirmation.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-25T13:55:47.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-15T16:37:17.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "User Profile Builder \u003c= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name Field"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-100186",
    "datePublished": "2026-10-16T05:30:28.153Z",
    "dateReserved": "2026-09-25T13:40:41.077Z",
    "dateUpdated": "2026-10-16T14:39:03.586Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100185",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T10:47:41.802426Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T16:43:49.850Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Directorist: AI-Powered Business Directory, Listings \u0026 Classified Ads",
          "vendor": "wpwax",
          "versions": [
            {
              "lessThanOrEqual": "8.10.2.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sorra"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Directorist: AI-Powered Business Directory, Listings \u0026 Classified Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027phone\u0027 Listing Field in all versions up to, and including, 8.10.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the plugin grants the edit_at_biz_dirs and publish_at_biz_dirs capabilities to the subscriber role, allowing any subscriber-level user to submit and publish listings without moderation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T03:40:05.353Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bdddb715-4c49-419f-a599-51ff0857393a?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/directorist/tags/8.9.6/includes/model/SingleListing.php#L1491"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/directorist/tags/8.9.6/includes/classes/class-add-listing.php#L303"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/directorist/tags/8.9.6/templates/single/fields/map.php#L10"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3730035%40directorist\u0026new=3730035%40directorist"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-25T13:55:40.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-13T15:09:17.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Directorist: AI-Powered Business Directory, Listings \u0026 Classified Ads \u003c= 8.10.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via \u0027phone\u0027 Listing Field"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-100185",
    "datePublished": "2026-10-14T03:40:05.353Z",
    "dateReserved": "2026-09-25T13:40:33.644Z",
    "dateUpdated": "2026-10-15T16:43:49.850Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100184",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-03T15:35:05.317240Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-03T15:42:51.710Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Calculated Fields Form \u2013 AI Form Builder for WordPress \u2013 Contact, Payment, Quote, Quiz \u0026 More",
          "vendor": "codepeople",
          "versions": [
            {
              "lessThanOrEqual": "5.5.1.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "UKO"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Calculated Fields Form \u2013 AI Form Builder for WordPress \u2013 Contact, Payment, Quote, Quiz \u0026 More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the \u0027x (attacker-chosen name matching the form\u0027s url.\u003cname\u003e predefined value)\u0027 parameter in all versions up to, and including, 5.5.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that the targeted form has a Text Area field configured with a \u0027url.\u003cname\u003e\u0027 Predefined Value and predefinedClick disabled, which is a documented and commonly used plugin feature."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-01T08:28:44.400Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6f1d2fe6-6cee-4e21-85ac-37d2d48156d2?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/calculated-fields-form/tags/5.5.1.2/js/fbuilder-pro-public.jquery.js#L692"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/calculated-fields-form/tags/5.5.1.2/js/fields-public/05_fbuilder.ftextarea.js#L23"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/calculated-fields-form/tags/5.5.1.2/js/fbuilder-pro-public.jquery.js#L1288"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/calculated-fields-form/tags/5.5.1.2/js/modules/08_url/public/01_url.js#L140"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3713574%40calculated-fields-form\u0026new=3713574%40calculated-fields-form"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-25T13:55:25.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-30T20:14:54.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Calculated Fields Form \u003c= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via \u0027x\u0027 URL Query Parameter via Text Area Predefined Value"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-100184",
    "datePublished": "2026-10-01T08:28:44.400Z",
    "dateReserved": "2026-09-25T13:40:20.684Z",
    "dateUpdated": "2026-10-03T15:42:51.710Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100182",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-02T18:01:44.795438Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-02T18:02:50.486Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Download Monitor",
          "vendor": "wpchill",
          "versions": [
            {
              "lessThanOrEqual": "5.2.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "whale120"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor in all versions up to, and including, 5.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to trick an authenticated Administrator into visiting an attacker-controlled page that targets an open Download edit screen, after which the payload is persisted unfiltered via the Administrator\u0027s unfiltered_html capability and later emitted verbatim to the frontend by the [download_data] shortcode\u0027s unescaped post_content render path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T07:39:23.520Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/59d4c073-af86-4e60-87f5-94cc46f407a2?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/download-monitor/tags/5.2.10/assets/js/download-operations.js#L34"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/download-monitor/tags/5.2.10/assets/js/download-operations.js#L11"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/download-monitor/tags/5.2.10/src/Shortcodes.php#L285"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/download-monitor/tags/5.2.10/src/Admin/AdminScripts.php#L56"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3716767%40download-monitor\u0026new=3716767%40download-monitor"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-25T13:54:31.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-01T18:54:22.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Download Monitor \u003c= 5.2.10 - Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-100182",
    "datePublished": "2026-10-02T07:39:23.520Z",
    "dateReserved": "2026-09-25T13:39:25.387Z",
    "dateUpdated": "2026-10-02T18:02:50.486Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100180",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-03T15:36:55.079608Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-03T15:42:47.431Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Jeg Kit for Elementor \u2013 Powerful Addons for Elementor, Widgets \u0026 Templates for WordPress",
          "vendor": "jegtheme",
          "versions": [
            {
              "lessThanOrEqual": "3.2.19",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Dthangws"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Jeg Kit for Elementor \u2013 Powerful Addons for Elementor, Widgets \u0026 Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 3.2.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Immediate persistence without moderator approval is possible when the attacker submits from an email address with at least one previously approved comment, though the widened allowlist bypasses sanitization regardless of approval status."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-03T02:25:34.900Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/961b9a16-0b99-4a56-a158-864d643d5c96?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/3.2.19/assets/js/elements/nav-menu.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/3.2.19/helper.php#L863"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/3.2.19/lib/jeg-framework/util/framework-helper.php#L144"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/3.2.19/assets/js/elements/video-button.js"
        },
        {
          "url": "https://wordpress.org/plugins/jeg-elementor-kit/"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/3.2.20/assets/js/elements/nav-menu.js"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-25T13:51:03.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-02T13:57:49.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Jeg Kit for Elementor \u003c= 3.2.19 - Unauthenticated Stored Cross-Site Scripting via Comment"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-100180",
    "datePublished": "2026-10-03T02:25:34.900Z",
    "dateReserved": "2026-09-25T13:35:59.335Z",
    "dateUpdated": "2026-10-03T15:42:47.431Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100179",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-01T14:06:04.022587Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-01T14:07:25.580Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Calculated Fields Form \u2013 AI Form Builder for WordPress \u2013 Contact, Payment, Quote, Quiz \u0026 More",
          "vendor": "codepeople",
          "versions": [
            {
              "lessThanOrEqual": "5.5.1.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "UKO"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Calculated Fields Form \u2013 AI Form Builder for WordPress \u2013 Contact, Payment, Quote, Quiz \u0026 More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the \u0027x (any URL parameter consumed by the form\u0027s calculated equation)\u0027 parameter in all versions up to, and including, 5.5.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the target site to have a public form configured with a Select2-enabled dropdown whose choices are populated via a calculated equation that pipes a URL parameter through GETURLPARAMETER() into setChoices({texts:[...]}); given that configuration, exploitation requires only a single crafted link."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-01T08:28:40.837Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/215a9f92-e922-4fa3-a4ac-83af788f4e55?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/calculated-fields-form/tags/5.5.1.2/js/fields-public/08_fbuilder.fdropdown.js#L84"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/calculated-fields-form/tags/5.5.1.2/js/fields-public/08_fbuilder.fdropdown.js#L240"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/calculated-fields-form/tags/5.5.1.2/js/modules/08_url/public/01_url.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3713574%40calculated-fields-form\u0026new=3713574%40calculated-fields-form"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-25T13:50:57.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-30T20:14:18.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Calculated Fields Form \u003c= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via \u0027x\u0027 URL Parameter via setChoices()"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-100179",
    "datePublished": "2026-10-01T08:28:40.837Z",
    "dateReserved": "2026-09-25T13:35:52.516Z",
    "dateUpdated": "2026-10-01T14:07:25.580Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100178",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-11T12:11:33.193306Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-11T12:13:43.901Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WPAdverts \u2013 Classifieds Plugin",
          "vendor": "gwin",
          "versions": [
            {
              "lessThanOrEqual": "2.3.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Morato Antoine"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WPAdverts \u2013 Classifieds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027adverts_location\u0027 parameter in all versions up to, and including, 2.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-10T07:41:45.869Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/84d362e2-a0ba-48e6-b4f5-46e080a7eee1?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wpadverts/tags/2.3.4/includes/functions-blocks.php#L483"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wpadverts/tags/2.3.4/includes/functions-blocks.php#L467"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wpadverts/tags/2.3.4/blocks/list/templates/list-item.php#L36"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wpadverts/tags/2.3.4/includes/functions.php#L1878"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wpadverts/tags/2.3.4/includes/functions.php#L1961"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wpadverts/tags/2.3.4/includes/defaults.php#L150"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wpadverts/tags/2.3.4/blocks/publish/class-publish-engine.php#L422"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wpadverts/trunk/readme.txt?rev=3732587"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3732587/wpadverts/trunk/includes/functions-blocks.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-25T13:50:48.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-09T19:25:05.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WPAdverts \u003c= 2.3.4 - Unauthenticated Stored Cross-Site Scripting via \u0027adverts_location\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-100178",
    "datePublished": "2026-10-10T07:41:45.869Z",
    "dateReserved": "2026-09-25T13:35:41.978Z",
    "dateUpdated": "2026-10-11T12:13:43.901Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100176",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-25T14:56:38.970855Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-25T14:59:28.644Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "username timeline (D3 timeline_basic)"
          ],
          "product": "ail framework",
          "programFiles": [
            "var/www/static/js/d3/timeline_basic.js"
          ],
          "repo": "https://github.com/ail-project/ail-framework",
          "vendor": "ail project",
          "versions": [
            {
              "lessThan": "7.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Aurelien Thirion"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Jeroen Pinoy"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe AIL Framework\u0027s username timeline feature is vulnerable to stored cross-site scripting (XSS). Usernames imported from chats and crawled forums are stored without character restrictions. When an authenticated analyst views the username timeline, the application renders these stored usernames into the DOM using D3\u0027s html() method in the tooltip. Because the username value (d.obj) is interpolated directly into an HTML string without sanitization, a crafted username containing HTML event handlers (e.g., \u0026lt;img src=x onerror=alert(1)\u0026gt;) will execute arbitrary JavaScript in the analyst\u0027s browser when the analyst hovers over the corresponding timeline entry. The attack requires the victim to be an authenticated analyst with access to the timeline view and to interact with the malicious timeline entry (hover). Successful exploitation can lead to session hijacking, data exfiltration, or unauthorized actions performed within the analyst\u0027s authenticated session. The vulnerability resides in the client-side JavaScript file var/www/static/js/d3/timeline_basic.js.\u003c/p\u003e"
            }
          ],
          "value": "The AIL Framework\u0027s username timeline feature is vulnerable to stored cross-site scripting (XSS). Usernames imported from chats and crawled forums are stored without character restrictions. When an authenticated analyst views the username timeline, the application renders these stored usernames into the DOM using D3\u0027s html() method in the tooltip. Because the username value (d.obj) is interpolated directly into an HTML string without sanitization, a crafted username containing HTML event handlers (e.g., \u003cimg src=x onerror=alert(1)\u003e) will execute arbitrary JavaScript in the analyst\u0027s browser when the analyst hovers over the corresponding timeline entry. The attack requires the victim to be an authenticated analyst with access to the timeline view and to interact with the malicious timeline entry (hover). Successful exploitation can lead to session hijacking, data exfiltration, or unauthorized actions performed within the analyst\u0027s authenticated session. The vulnerability resides in the client-side JavaScript file var/www/static/js/d3/timeline_basic.js."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Cross Site Scripting"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T13:29:17.333Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ail-project/ail-framework/commit/455dd92c4179c53204368d93681ded4b57e31643"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix applies the existing sanitize_text() helper to the user-controlled username value (d.obj) immediately before it is interpolated into the D3 tooltip HTML string. This ensures that any HTML or script content embedded in the stored username is neutralized before DOM insertion, preventing script execution while preserving the tooltip\u0027s intended formatting (line breaks and date/time display).\u003c/p\u003e"
            }
          ],
          "value": "The fix applies the existing sanitize_text() helper to the user-controlled username value (d.obj) immediately before it is interpolated into the D3 tooltip HTML string. This ensures that any HTML or script content embedded in the stored username is neutralized before DOM insertion, preventing script execution while preserving the tooltip\u0027s intended formatting (line breaks and date/time display)."
        }
      ],
      "title": "Stored Cross-Site Scripting (XSS) in AIL Framework Username Timeline Tooltip",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "none",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The UI:A (Active) user interaction metric assumes the analyst must deliberately hover over the specific timeline entry to trigger the XSS; passive rendering without hover is not evidenced in the patch.",
                  "The affected version boundary is inferred from the tag_version_boundary metadata (v7.1, 29 commits after fix); the exact last affected and first fixed version numbers are not explicitly stated in the patch.",
                  "PR:N assumes the attacker does not need an account on the AIL Framework itself, only a presence in a crawled chat or forum source; if the platform requires the attacker to be a registered user to have their username crawled, PR:L might be more appropriate.",
                  "The CAPEC-1 mapping is the closest available pattern for stored XSS; no more specific CAPEC ID for \u0027stored XSS via imported data rendered in a tooltip\u0027 exists in the CAPEC catalog.",
                  "The sanitize_text() helper is assumed to perform adequate HTML entity encoding or equivalent neutralization; its implementation is not shown in the patch.",
                  "VC:H and VI:H reflect the sensitivity of an intelligence-analysis platform where an authenticated analyst session may contain classified or highly sensitive data; if the deployment context is less sensitive, lower impact ratings could apply."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-1",
                    "rationale": "CAPEC-1 describes the general pattern of injecting client-side scripts into web pages via untrusted input. The patch evidence shows a stored username (untrusted input from chats/forums) being rendered into an HTML tooltip without sanitization, matching the stored-XSS sub-pattern of CAPEC-1. This is the closest and most direct CAPEC mapping for an XSS vulnerability where attacker-controlled data is persisted and later rendered in a victim\u0027s browser."
                  }
                ],
                "commit": "455dd92c4179c53204368d93681ded4b57e31643",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "terrtia"
                  }
                ],
                "cvssRationale": "AV:N: The vulnerability is in a web application accessible over the network. AC:L: The attacker only needs to craft a username with HTML/JS in a chat or forum that gets crawled; no race conditions or complex conditions are needed. AT:N: No attack on the target system is required; the malicious username is stored as part of normal data import. PR:N: The attacker does not need any account or privilege on the AIL Framework; they only need to be a user in a source chat/forum. UI:A: The victim (analyst) must actively hover over the specific timeline entry to trigger script execution. VC:H: XSS in an authenticated analyst session can expose sensitive intelligence data, session tokens, and credentials. VI:H: The attacker can perform actions as the analyst, modify data, or exfiltrate information. VA:N: No impact on availability. SC/SI/SA:N: No subsequent system impact is evidenced.",
                "fixSummary": "The fix applies the existing sanitize_text() helper to the user-controlled username value (d.obj) immediately before it is interpolated into the D3 tooltip HTML string. This ensures that any HTML or script content embedded in the stored username is neutralized before DOM insertion, preventing script execution while preserving the tooltip\u0027s intended formatting (line breaks and date/time display).",
                "generatedAt": "2026-09-25T13:24:29.029450Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 6,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 4
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "36262636a3a75bbee1ac4f863ce7a5ce7939eb2e21fed5ede98403d38c29ec40",
                "patchSummary": "In var/www/static/js/d3/timeline_basic.js, the single line constructing the tooltip HTML was changed from tooltip.html(`${d.obj}\u003cbr\u003e...`) to tooltip.html(`${sanitize_text(d.obj)}\u003cbr\u003e...`). The only modification is wrapping the untrusted d.obj variable with the sanitize_text() function call at the HTML sink, leaving the rest of the tooltip template (br tags, date formatting) unchanged.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "455dd92c4179c53204368d93681ded4b57e31643",
                    "patchSha256": "36262636a3a75bbee1ac4f863ce7a5ce7939eb2e21fed5ede98403d38c29ec40",
                    "source": "https://github.com/ail-project/ail-framework/commit/455dd92c4179c53204368d93681ded4b57e31643.patch",
                    "sourceUrl": "https://github.com/ail-project/ail-framework/commit/455dd92c4179c53204368d93681ded4b57e31643.patch",
                    "subject": "chg: [security] fix XSS in username timeline tooltip."
                  }
                ],
                "source": "https://github.com/ail-project/ail-framework/commit/455dd92c4179c53204368d93681ded4b57e31643.patch",
                "subject": "chg: [security] fix XSS in username timeline tooltip.",
                "tagVersionBoundary": {
                  "commits_after_fix": 29,
                  "repository": "https://github.com/ail-project/ail-framework",
                  "tag": "v7.1",
                  "version": "7.1",
                  "version_type": "custom"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-79",
                    "rationale": "The patch inserts a user-controlled value (username from imported chats/forums) into an HTML context via D3\u0027s html() method without sanitization. The fix adds sanitize_text() at the sink, confirming the root cause is missing output encoding/neutralization of untrusted data in an HTML context, which is the definition of CWE-79 (stored XSS variant)."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20279"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-100176",
    "datePublished": "2026-09-25T13:29:17.333Z",
    "dateReserved": "2026-09-25T13:29:14.017Z",
    "dateUpdated": "2026-09-25T14:59:28.644Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}