CWE-79

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100175",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T01:30:23.578437Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T01:41:52.993Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Postie",
          "vendor": "wayneallen-1",
          "versions": [
            {
              "lessThanOrEqual": "1.9.87",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Postie plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Body URL Autolink in all versions up to, and including, 1.9.87 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the ?postie=get-mail endpoint is reachable by unauthenticated users with no capability check, and the email processing path removes WordPress\u0027s kses output filters before saving raw markup, allowing the unescaped href attribute value to be stored as post content."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T06:45:12.519Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5b7d5d53-51a0-4d45-a180-0bde9edd8f4c?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/postie/tags/1.9.87/lib/autolink.php#L220"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/postie/tags/1.9.87/lib/autolink.php#L136"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/postie/tags/1.9.87/lib/autolink.php#L129"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/postie/tags/1.9.87/postie-filters.php#L475"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/postie/tags/1.9.87/postie-message.php#L607"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/postie/tags/1.9.87/postie-message.php#L1311"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/postie/tags/1.9.87/postie.php#L241"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3751269"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-15T13:20:30.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-27T18:36:05.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Postie \u003c= 1.9.87 - Unauthenticated Stored Cross-Site Scripting via Email Body URL Autolink"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-100175",
    "datePublished": "2026-10-28T06:45:12.519Z",
    "dateReserved": "2026-09-25T13:23:48.400Z",
    "dateUpdated": "2026-10-29T01:41:52.993Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100174",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-25T15:14:24.607198Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-25T15:14:51.969Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "tag selector (tags.js)"
          ],
          "product": "ail framework",
          "programFiles": [
            "var/www/static/js/tags.js"
          ],
          "repo": "https://github.com/ail-project/ail-framework",
          "vendor": "ail project",
          "versions": [
            {
              "lessThan": "7.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Aurelien Thirion"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Jeroen Pinoy"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe AIL Framework tag selector component (var/www/static/js/tags.js) is vulnerable to stored cross-site scripting (XSS). A user with the ability to create a custom tag could embed an HTML payload containing JavaScript event handlers (e.g., \u0026lt;img src=x onerror=alert(1)\u0026gt; or \u0026lt;svg onload=...\u0026gt;) in the tag name. When another authenticated user opened a page containing the tag selector, the malicious tag name was inserted into the DOM using jQuery\u0027s html property, causing the embedded script to execute in the victim\u0027s browser context.\u003c/p\u003e\u003cp\u003eThe vulnerable code paths affected both the suggestion/combo-item rendering (_renderComboItems) and the selected-tag rendering logic. In both cases, the display value derived from the tag\u0027s displayField was passed directly to the html property of a jQuery element constructor, which parses and inserts the string as raw HTML rather than as text.\u003c/p\u003e\u003cp\u003ePreconditions: the attacker must have an authenticated account with permission to create custom tags, and the victim must be an authenticated user who views a page that renders the tag selector with the attacker\u0027s stored tag. The attack is stored (persistent) and does not require the victim to perform any action beyond loading the page.\u003c/p\u003e\u003cp\u003eSecurity impact: successful exploitation allows arbitrary JavaScript execution in the victim\u0027s browser within the application\u0027s origin, potentially leading to session hijacking, unauthorized data access, form manipulation, or further client-side attacks.\u003c/p\u003e"
            }
          ],
          "value": "The AIL Framework tag selector component (var/www/static/js/tags.js) is vulnerable to stored cross-site scripting (XSS). A user with the ability to create a custom tag could embed an HTML payload containing JavaScript event handlers (e.g., \u003cimg src=x onerror=alert(1)\u003e or \u003csvg onload=...\u003e) in the tag name. When another authenticated user opened a page containing the tag selector, the malicious tag name was inserted into the DOM using jQuery\u0027s html property, causing the embedded script to execute in the victim\u0027s browser context.\n\nThe vulnerable code paths affected both the suggestion/combo-item rendering (_renderComboItems) and the selected-tag rendering logic. In both cases, the display value derived from the tag\u0027s displayField was passed directly to the html property of a jQuery element constructor, which parses and inserts the string as raw HTML rather than as text.\n\nPreconditions: the attacker must have an authenticated account with permission to create custom tags, and the victim must be an authenticated user who views a page that renders the tag selector with the attacker\u0027s stored tag. The attack is stored (persistent) and does not require the victim to perform any action beyond loading the page.\n\nSecurity impact: successful exploitation allows arbitrary JavaScript execution in the victim\u0027s browser within the application\u0027s origin, potentially leading to session hijacking, unauthorized data access, form manipulation, or further client-side attacks."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-66",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-66 Cross Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T13:22:38.669Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ail-project/ail-framework/commit/b2d0ed05f6cf79b2312a3f1f923d0d1a5d7a9edb"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix ensures that tag names and display values are rendered as plain text rather than as HTML when no custom renderer is explicitly configured. In the suggestion rendering path, the default (non-renderer) case now uses jQuery\u0027s .text() method, which HTML-escapes the content. In the selection rendering path, the default case uses document.createTextNode() to insert the value as a text node. Custom renderers, which are developer-supplied and trusted to produce safe HTML, continue to use .html() or .prepend() with raw HTML. The eval() call was also replaced with JSON.parse() to eliminate a code-injection vector.\u003c/p\u003e"
            }
          ],
          "value": "The fix ensures that tag names and display values are rendered as plain text rather than as HTML when no custom renderer is explicitly configured. In the suggestion rendering path, the default (non-renderer) case now uses jQuery\u0027s .text() method, which HTML-escapes the content. In the selection rendering path, the default case uses document.createTextNode() to insert the value as a text node. Custom renderers, which are developer-supplied and trusted to produce safe HTML, continue to use .html() or .prepend() with raw HTML. The eval() call was also replaced with JSON.parse() to eliminate a code-injection vector."
        }
      ],
      "title": "Stored Cross-Site Scripting (XSS) in AIL Framework Tag Selector via Unescaped Tag Names",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "none",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version range is inferred from the tag_version_boundary metadata indicating the fix commit is 31 commits before the v7.1 tag; exact version boundaries are not explicitly stated in the patch.",
                  "The UI:P (Passive) rating assumes the victim only needs to load a page containing the tag selector; if the application requires the victim to explicitly open a specific dialog or widget, UI:A (Active) could be more appropriate.",
                  "The CAPEC-66 mapping is the closest available pattern; no CAPEC entry specifically covers stored XSS in a tag-selector UI component, so the general XSS pattern is used.",
                  "The PR:L rating assumes that creating a custom tag requires only a basic authenticated account; if tag creation requires elevated privileges, PR:H would be more appropriate.",
                  "The eval() to JSON.parse() change is treated as a secondary hardening fix within the same patch set; the primary vulnerability addressed is the stored XSS in tag rendering.",
                  "No specific reporter or finder is identified in the patch metadata or commit message; only the remediation developer (commit author) is credited."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-66",
                    "rationale": "CAPEC-66 describes the general XSS attack pattern where attacker-controlled input is reflected or stored and later rendered as executable content in a victim\u0027s browser. This patch fixes a stored XSS variant where malicious tag names are persisted and rendered as HTML. The mapping is direct and well-supported by the commit message and code changes. No more specific CAPEC entry for stored XSS in a tag/selector widget exists in the CAPEC catalog, making CAPEC-66 the closest and most appropriate match."
                  }
                ],
                "commit": "b2d0ed05f6cf79b2312a3f1f923d0d1a5d7a9edb",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "terrtia"
                  }
                ],
                "cvssRationale": "AV:N: The vulnerability is exploitable over the network via a web application. AC:L: No race conditions or special timing are required; the payload is stored and triggers on page load. AT:N: No manipulation of the attack target is needed; the stored payload executes automatically. PR:L: The attacker needs a low-privilege authenticated account with permission to create custom tags. UI:P: The victim passively interacts by loading a page that contains the tag selector; no active click or download is required. VC:L: The XSS can read data from the victim\u0027s session and page context. VI:L: The XSS can modify page content and submit forms. VA:N: No availability impact is evident. SC:L: The compromised session can access other resources within the same origin. SI:L: The attacker can modify data through the victim\u0027s authenticated session. SA:N: No availability impact on subsequent components.",
                "fixSummary": "The fix ensures that tag names and display values are rendered as plain text rather than as HTML when no custom renderer is explicitly configured. In the suggestion rendering path, the default (non-renderer) case now uses jQuery\u0027s .text() method, which HTML-escapes the content. In the selection rendering path, the default case uses document.createTextNode() to insert the value as a text node. Custom renderers, which are developer-supplied and trusted to produce safe HTML, continue to use .html() or .prepend() with raw HTML. The eval() call was also replaced with JSON.parse() to eliminate a code-injection vector.",
                "generatedAt": "2026-09-25T13:16:06.156442Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 6,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 4
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "2d147dabcc9bebce7722917d80f13e49a10f9a2a4089ec6207cce9edb9187f77",
                "patchSummary": "In var/www/static/js/tags.js: (1) Replaced eval(data) with JSON.parse(data) for parsing array-like data strings. (2) In _renderComboItems, introduced a hasRenderer flag; when no custom renderer is set, the displayed value is inserted via resultItemEl.text(displayed) instead of the html property in the jQuery constructor. (3) In the selection rendering block, introduced a hasSelectionRenderer flag; when no custom selection renderer is set, the value is prepended as a text node via document.createTextNode(selectedItemHtml) instead of being set through the html property. (4) The comma separator for text-mode selections is now appended as a text node rather than concatenated into an HTML string.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "b2d0ed05f6cf79b2312a3f1f923d0d1a5d7a9edb",
                    "patchSha256": "2d147dabcc9bebce7722917d80f13e49a10f9a2a4089ec6207cce9edb9187f77",
                    "source": "https://github.com/ail-project/ail-framework/commit/b2d0ed05f6cf79b2312a3f1f923d0d1a5d7a9edb.patch",
                    "sourceUrl": "https://github.com/ail-project/ail-framework/commit/b2d0ed05f6cf79b2312a3f1f923d0d1a5d7a9edb.patch",
                    "subject": "chg: [security] prevent stored XSS in"
                  }
                ],
                "source": "https://github.com/ail-project/ail-framework/commit/b2d0ed05f6cf79b2312a3f1f923d0d1a5d7a9edb.patch",
                "subject": "chg: [security] prevent stored XSS in",
                "tagVersionBoundary": {
                  "commits_after_fix": 31,
                  "repository": "https://github.com/ail-project/ail-framework",
                  "tag": "v7.1",
                  "version": "7.1",
                  "version_type": "custom"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-79",
                    "rationale": "The patch explicitly addresses stored XSS: user-controlled tag names were inserted into the DOM as HTML via jQuery\u0027s html property without escaping. The fix renders these values as text nodes, which is the canonical remediation for CWE-79. The commit subject line also explicitly states \u0027prevent stored XSS\u0027."
                  },
                  {
                    "cweId": "CWE-94",
                    "rationale": "The replacement of eval(data) with JSON.parse(data) addresses a secondary code-injection weakness where a crafted data string could execute arbitrary JavaScript. This is a contributing factor but the primary vulnerability is the stored XSS in tag rendering."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20269"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-100174",
    "datePublished": "2026-09-25T13:22:38.669Z",
    "dateReserved": "2026-09-25T13:22:15.197Z",
    "dateUpdated": "2026-09-25T15:14:51.969Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100172",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-25T15:15:12.313075Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-25T15:19:12.598Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "chats_explorer (block_message.html)",
            "objects/item (show_item.html)"
          ],
          "product": "ail framework",
          "programFiles": [
            "var/www/templates/chats_explorer/block_message.html",
            "var/www/templates/objects/item/show_item.html"
          ],
          "repo": "https://github.com/ail-project/ail-framework",
          "vendor": "ail project",
          "versions": [
            {
              "lessThan": "7.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Aurelien Thirion"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Jeroen Pinoy"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe AIL Framework (ail-project/ail-framework) contains a stored cross-site scripting (XSS) vulnerability in two Jinja2 templates that render popovers for matched, tracked, or tagged content: var/www/templates/chats_explorer/block_message.html and var/www/templates/objects/item/show_item.html. In both templates, dynamic values associated with this content, including icon color, icon style, icon glyph, subtype, identifier, name, description, and matched value, are interpolated directly into the data-content HTML attribute of Bootstrap popover elements without appropriate output encoding. Because the popovers are configured with data-html=\"true\", the content is interpreted as HTML in the victim\u0027s browser. An authenticated attacker who can influence matched, tracked, or tagged content may inject arbitrary HTML or JavaScript into these values. When a victim displays the affected popover, the injected markup may execute in the victim\u0027s session, potentially enabling data exfiltration or actions with the victim\u0027s privileges. The vulnerability is classified as stored XSS because the malicious payload can persist in the affected match, tracking, or tag-related data and be delivered to users who view the affected content.\u003c/p\u003e"
            }
          ],
          "value": "The AIL Framework (ail-project/ail-framework) contains a stored cross-site scripting (XSS) vulnerability in two Jinja2 templates that render popovers for matched, tracked, or tagged content: var/www/templates/chats_explorer/block_message.html and var/www/templates/objects/item/show_item.html. In both templates, dynamic values associated with this content, including icon color, icon style, icon glyph, subtype, identifier, name, description, and matched value, are interpolated directly into the data-content HTML attribute of Bootstrap popover elements without appropriate output encoding. Because the popovers are configured with data-html=\"true\", the content is interpreted as HTML in the victim\u0027s browser. An authenticated attacker who can influence matched, tracked, or tagged content may inject arbitrary HTML or JavaScript into these values. When a victim displays the affected popover, the injected markup may execute in the victim\u0027s session, potentially enabling data exfiltration or actions with the victim\u0027s privileges. The vulnerability is classified as stored XSS because the malicious payload can persist in the affected match, tracking, or tag-related data and be delivered to users who view the affected content."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Cross Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T13:13:56.996Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ail-project/ail-framework/commit/ee63a0a96646790255e038f5ca5dd0ab5fe98db2"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix applies double HTML-escaping (Jinja2 forceescape|forceescape) to every dynamic value interpolated into the HTML-enabled data-content attribute of the popover elements in both templates. Double-escaping is required because the values must survive both the outer HTML attribute context and the inner HTML parsing performed by the popover plugin. This neutralizes any HTML or script injection from the extracted-match fields.\u003c/p\u003e"
            }
          ],
          "value": "The fix applies double HTML-escaping (Jinja2 forceescape|forceescape) to every dynamic value interpolated into the HTML-enabled data-content attribute of the popover elements in both templates. Double-escaping is required because the values must survive both the outer HTML attribute context and the inner HTML parsing performed by the popover plugin. This neutralizes any HTML or script injection from the extracted-match fields."
        }
      ],
      "title": "Stored XSS in AIL Framework extracted-match popovers via unescaped dynamic values in HTML-enabled data-content attributes",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "none",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The AIL Framework requires authenticated access to create or modify chat messages and items; PR:L is assumed based on the application being a threat-intelligence platform with user accounts.",
                  "The extracted-match data (icon color, style, subtype, id, name, description) can be influenced by an authenticated user through normal application workflows (e.g., submitting content that the extraction pipeline processes).",
                  "The popover is triggered on hover (data-trigger=\"hover\"), classified as passive user interaction (UI:P).",
                  "The tag v7.1 boundary with 143 commits after the fix suggests the fix landed before v7.1, but exact affected version ranges are not confirmed by the patch alone.",
                  "CAPEC-1 is selected as the closest standard attack pattern; no more specific CAPEC for stored XSS in HTML attributes exists in the CAPEC catalog."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-1",
                    "rationale": "The patch directly addresses stored XSS: attacker-controlled content is persisted in application data (chat messages, items) and rendered as executable HTML in a victim\u0027s browser via an unescaped data-content attribute. CAPEC-1 is the canonical attack pattern for XSS and is the closest match. No uncertainty in this mapping."
                  }
                ],
                "commit": "ee63a0a96646790255e038f5ca5dd0ab5fe98db2",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "terrtia"
                  }
                ],
                "cvssRationale": "AV:N: web application reachable over the network. AC:L: crafting a message or item with a malicious extracted-match value requires no special race or timing. AT:N: no manipulation of the attack target is needed. PR:L: the attacker must be an authenticated user capable of creating or modifying chat messages or items. UI:P: the victim must passively interact (hover over the element) to trigger the popover rendering; no click or explicit action is required. VC:H: the injected script can read session cookies, DOM data, and API responses in the victim\u0027s browser. VI:H: the script can perform authenticated actions on behalf of the victim (create, modify, delete data). VA:N: no direct denial-of-service impact is evident. SC/SI/SA:N: the subcomponent (the AIL Framework server) is not directly compromised; the impact is confined to the victim\u0027s browser session.",
                "fixSummary": "The fix applies double HTML-escaping (Jinja2 forceescape|forceescape) to every dynamic value interpolated into the HTML-enabled data-content attribute of the popover elements in both templates. Double-escaping is required because the values must survive both the outer HTML attribute context and the inner HTML parsing performed by the popover plugin. This neutralizes any HTML or script injection from the extracted-match fields.",
                "generatedAt": "2026-09-25T12:56:24.137641Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "bd188338f8828ab59743776228d2991b51a3f83b870dedf073a54c6139ad9e26",
                "patchSummary": "In block_message.html and show_item.html, the Jinja2 expressions for extracted_matches fields (icon color, icon style, icon, subtype, id, name, description) and the matched value r[1] are each suffixed with |forceescape|forceescape. No other logic, routing, or configuration changes are made. Two lines changed in total (one per file).",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "ee63a0a96646790255e038f5ca5dd0ab5fe98db2",
                    "patchSha256": "bd188338f8828ab59743776228d2991b51a3f83b870dedf073a54c6139ad9e26",
                    "source": "https://github.com/ail-project/ail-framework/commit/ee63a0a96646790255e038f5ca5dd0ab5fe98db2.patch",
                    "sourceUrl": "https://github.com/ail-project/ail-framework/commit/ee63a0a96646790255e038f5ca5dd0ab5fe98db2.patch",
                    "subject": "chg: [security] fix XSS in show item and message popover of"
                  }
                ],
                "source": "https://github.com/ail-project/ail-framework/commit/ee63a0a96646790255e038f5ca5dd0ab5fe98db2.patch",
                "subject": "chg: [security] fix XSS in show item and message popover of",
                "tagVersionBoundary": {
                  "commits_after_fix": 143,
                  "repository": "https://github.com/ail-project/ail-framework",
                  "tag": "v7.1",
                  "version": "7.1",
                  "version_type": "custom"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-79",
                    "rationale": "Dynamic values from extracted-match data are interpolated into an HTML-enabled attribute without output encoding, allowing script injection. The fix adds forceescape, confirming the root cause is missing output encoding in an HTML context. CWE-79 is the precise weakness."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20239"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-100172",
    "datePublished": "2026-09-25T13:13:56.996Z",
    "dateReserved": "2026-09-25T13:13:52.747Z",
    "dateUpdated": "2026-09-25T15:19:12.598Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100161",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-11T12:13:43.571698Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-11T12:23:55.418Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Photo Reviews for WooCommerce",
          "vendor": "villatheme",
          "versions": [
            {
              "lessThanOrEqual": "1.2.30",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Adrien Brunner"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the \u0027wcpr_image_upload_id\u0027 parameter in all versions up to, and including, 1.2.30 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The publicly-emitted `wcpr_image_upload` nonce printed on every product review form is the only gate, and no capability, authentication, or attachment ownership check is performed, allowing the payload to be stored in comment meta \u2014 which is not subject to `wp_kses` \u2014 by any unauthenticated visitor; the XSS fires once the review is visible on the frontend."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-10T06:40:12.618Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7b1e4f3b-071b-4ef7-9a07-f26da45b916e?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-photo-reviews/trunk/js/default-display-images.js#L17"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-photo-reviews/trunk/frontend/frontend.php#L1268"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-photo-reviews/trunk/templates/viwcpr-template-basic-html.php#L64"
        },
        {
          "url": "https://vi.wordpress.org/plugins/woo-photo-reviews/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-25T12:34:49.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-09T17:46:05.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Photo Reviews for WooCommerce \u003c= 1.2.30 - Unauthenticated Stored DOM-Based Cross-Site Scripting via \u0027wcpr_image_upload_id\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-100161",
    "datePublished": "2026-10-10T06:40:12.618Z",
    "dateReserved": "2026-09-25T12:19:45.294Z",
    "dateUpdated": "2026-10-11T12:23:55.418Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100158",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T14:34:41.886031Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T14:39:05.141Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SQL Chart Builder",
          "vendor": "elvinhaci",
          "versions": [
            {
              "lessThanOrEqual": "3.0.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "rwcpower100"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027X-axis column value ($value-\u003e$xarg_s from $wpdb-\u003eget_results())\u0027 parameter in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have published a chart whose SQL query returns a column controllable by a lower-privileged user, such as wp_users.display_name, which a Subscriber can populate with a payload via the standard WordPress profile page at /wp-admin/profile.php."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T05:30:19.302Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/16375398-c5c9-465f-9a2f-4c08f76b090b?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/sql-chart-builder/tags/3.0.6/functions.php#L579"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/sql-chart-builder/tags/3.0.6/functions.php#L1093"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/sql-chart-builder/tags/3.0.6/functions.php#L1019"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/sql-chart-builder/tags/3.0.6/functions.php#L1101"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/sql-chart-builder/tags/3.0.6/functions.php#L820"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3725657%40sql-chart-builder\u0026new=3725657%40sql-chart-builder"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-15T17:01:02.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "SQL Chart Builder \u003c= 3.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SQL Chart Label (X-axis) via Stored User Field"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-100158",
    "datePublished": "2026-10-16T05:30:19.302Z",
    "dateReserved": "2026-09-25T12:19:13.797Z",
    "dateUpdated": "2026-10-16T14:39:05.141Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100153",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T14:21:29.922454Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T14:21:49.327Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "NewStatPress",
          "vendor": "ice00",
          "versions": [
            {
              "lessThanOrEqual": "1.4.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Md. Moniruzzaman Prodhan (NomanProdhan)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027QUERY_STRING / REQUEST_URI\u0027 parameter in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has placed the [NewStatPress type=\"Top Pages\"] shortcode on a publicly viewable page, and that the attacker\u0027s crafted URL accumulates enough hits to appear in the top-N ranking."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T03:40:07.066Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fe3a7196-690b-45bb-a34f-05981f6780f1?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/newstatpress/tags/1.4.5/includes/nsp-core.php#L876"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/newstatpress/tags/1.4.5/newstatpress.php#L839"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/newstatpress/tags/1.4.5/newstatpress.php#L1453"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-13T15:38:02.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "NewStatPress \u003c= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via URL Request Tracking (urlrequested field)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-100153",
    "datePublished": "2026-10-14T03:40:07.066Z",
    "dateReserved": "2026-09-25T12:05:15.078Z",
    "dateUpdated": "2026-10-14T14:21:49.327Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100151",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-01T17:33:54.649429Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-01T17:34:18.422Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures \u0026 AI Form Builder",
          "vendor": "kstover",
          "versions": [
            {
              "lessThanOrEqual": "3.15.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kuba"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures \u0026 AI Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via \u0027querystring:\u003ckey\u003e\u0027 URL Parameter in all versions up to, and including, 3.15.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This bypass is triggered when an attacker supplies a matching field:\u0026lt;key\u0026gt; URL parameter that causes the server to fully resolve the {field:*} placeholder, forcing the client-side else-branch to abandon the server-sanitized value and reconstruct field content from the raw query string."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-31T09:29:26.798Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/82ace2e3-1120-4be9-a7c6-b64590c8a35f?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.4/assets/js/min/front-end.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.4/includes/Templates/fields-html.html#L2"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.4/includes/MergeTags/Other.php#L41"
        },
        {
          "url": "https://wordpress.org/plugins/ninja-forms/"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3749135/ninja-forms/trunk/assets/js/min/front-end.js"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-25T12:18:20.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-30T21:10:48.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Ninja Forms \u003c= 3.15.5 - Reflected DOM-Based Cross-Site Scripting via \u0027querystring:\u003ckey\u003e\u0027 URL Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-100151",
    "datePublished": "2026-10-31T09:29:26.798Z",
    "dateReserved": "2026-09-25T12:03:16.008Z",
    "dateUpdated": "2026-11-01T17:34:18.422Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100148",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-03T15:26:26.250459Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-03T15:42:43.676Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Rich Showcase for Google Reviews",
          "vendor": "widgetpack",
          "versions": [
            {
              "lessThanOrEqual": "7.1.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakub Herman"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027reviews[].text\u0027 parameter in all versions up to, and including, 7.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is delivered entirely through a Google review posted for the connected business and requires no WordPress account; the plugin\u0027s default daily cron auto-imports the malicious review text, and execution triggers for every visitor on DOMContentLoaded without any further user interaction."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-03T05:29:18.617Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f2f3a5be-0b69-43aa-a56f-d602d5def7dc?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/7.1.2/assets/7.1.2/js/public-main.js#L14"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/7.1.2/includes/class-view.php#L535"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/7.1.2/includes/class-view.php#L453"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/7.1.2/includes/core/class-google-dao.php#L410"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/widget-google-reviews/tags/7.1.2/includes/core/class-google-dao.php#L445"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3719682%40widget-google-reviews\u0026new=3719682%40widget-google-reviews"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-25T11:56:29.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-02T17:16:42.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Rich Showcase for Google Reviews \u003c= 7.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Google Review Text (imported via Places API)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-100148",
    "datePublished": "2026-10-03T05:29:18.617Z",
    "dateReserved": "2026-09-25T11:41:25.358Z",
    "dateUpdated": "2026-10-03T15:42:43.676Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100147",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-11T12:12:10.253950Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-11T12:13:44.537Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FunnelKit \u2013 Funnel Builder for WooCommerce Checkout",
          "vendor": "teamfunnelkit",
          "versions": [
            {
              "lessThanOrEqual": "3.16.0.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "crow"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The FunnelKit \u2013 Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027shipping_first_name\u0027 parameter in all versions up to, and including, 3.16.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-10T07:41:43.163Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1807b544-e5fd-403b-85a6-e20bd4f10dec?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.16.0.5/modules/thankyou-pages/includes/class-wffn-ecomm-tracking.php#L211"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.16.0.5/modules/thankyou-pages/includes/class-wffn-ecomm-tracking.php#L1114"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3733861/"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3733886/funnel-builder/trunk/modules/thankyou-pages/includes/class-wffn-ecomm-tracking.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-25T11:56:10.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-09T19:41:06.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "FunnelKit \u003c= 3.16.0.5 - Unauthenticated Stored Cross-Site Scripting via Order Fields (shipping/billing)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-100147",
    "datePublished": "2026-10-10T07:41:43.163Z",
    "dateReserved": "2026-09-25T11:41:04.142Z",
    "dateUpdated": "2026-10-11T12:13:44.537Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100133",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T22:24:30.570579Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T22:24:50.982Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Adobe Commerce",
          "vendor": "Adobe",
          "versions": [
            {
              "lessThanOrEqual": "2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2.4.10-alpha1,2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct, 2.4.6-2026-oct, 2.4.5-2026-oct, 2.4.4-2026-oct",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Adobe Commerce B2B",
          "vendor": "Adobe",
          "versions": [
            {
              "lessThanOrEqual": "1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, 1.3.3-2026-sep",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "1.5.4-alpha1,1.5.3-2026-oct, 1.5.2-2026-oct, 1.4.2-2026-oct, 1.3.4-2026-oct, 1.3.3-2026-oct",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Magento Open Source",
          "vendor": "Adobe",
          "versions": [
            {
              "lessThanOrEqual": "2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2.4.10-alpha1,2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2026-10-13T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim\u0027s browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim\u0027s account or session. Scope is changed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "confidentialityRequirement": "NOT_DEFINED",
            "environmentalScore": 9.3,
            "environmentalSeverity": "CRITICAL",
            "exploitCodeMaturity": "NOT_DEFINED",
            "integrityImpact": "HIGH",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "LOW",
            "modifiedAttackVector": "NETWORK",
            "modifiedAvailabilityImpact": "NONE",
            "modifiedConfidentialityImpact": "HIGH",
            "modifiedIntegrityImpact": "HIGH",
            "modifiedPrivilegesRequired": "NONE",
            "modifiedScope": "CHANGED",
            "modifiedUserInteraction": "REQUIRED",
            "privilegesRequired": "NONE",
            "remediationLevel": "NOT_DEFINED",
            "reportConfidence": "NOT_DEFINED",
            "scope": "CHANGED",
            "temporalScore": 9.3,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Cross-site Scripting (Stored XSS) (CWE-79)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:15:47.406Z",
        "orgId": "078d4453-3bcd-4900-85e6-15281da43538",
        "shortName": "adobe"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.adobe.com/trust/security/products/commerce/apsb26-153.html"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
    "assignerShortName": "adobe",
    "cveId": "CVE-2026-100133",
    "datePublished": "2026-10-13T18:15:47.406Z",
    "dateReserved": "2026-09-25T11:21:55.101Z",
    "dateUpdated": "2026-10-16T22:24:50.982Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}