CVE-2026-0608

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0608", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-05T15:36:48.554Z", "datePublished": "2026-01-20T14:26:33.497Z", "dateUpdated": "2026-04-08T17:10:04.176Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:10:04.176Z"}, "affected": [{"vendor": "specialk", "product": "Head Meta Data", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "20251118", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Head Meta Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'head-meta-data' post meta field in all versions up to, and including, 20251118 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Head Meta Data <= 20251118 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9592bb6d-8e1d-4c89-addd-11c07272a628?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?old_path=/head-meta-data/tags/20251118&new_path=/head-meta-data/tags/20260105"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "timeline": [{"time": "2025-12-26T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-01-05T21:22:14.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-20T01:55:44.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-20T14:48:53.765165Z", "id": "CVE-2026-0608", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T14:49:46.704Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0608", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-20T14:48:53.765165Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T14:49:41.089Z"}}], "cna": {"title": "Head Meta Data <= 20251118 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "specialk", "product": "Head Meta Data", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "20251118"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-26T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-01-05T21:22:14.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-20T01:55:44.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9592bb6d-8e1d-4c89-addd-11c07272a628?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?old_path=/head-meta-data/tags/20251118&new_path=/head-meta-data/tags/20260105"}], "descriptions": [{"lang": "en", "value": "The Head Meta Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'head-meta-data' post meta field in all versions up to, and including, 20251118 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:10:04.176Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0608", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:10:04.176Z", "dateReserved": "2026-01-05T15:36:48.554Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-20T14:26:33.497Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Head Meta Data", "vendor": "specialk", "versions": [{"lessThanOrEqual": "20251118", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Head Meta Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'head-meta-data' post meta field in all versions up to, and including, 20251118 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Head Meta Data para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del campo meta de publicaci\u00f3n 'head-meta-data' en todas las versiones hasta, e incluyendo, 20251118 debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto hace posible que atacantes autenticados, con acceso de nivel de colaborador y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2026-0608", "lastModified": "2026-06-17T10:11:04.453", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0608", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-20T14:48:53.765165Z", "version": "2.0.3"}}]}, "published": "2026-01-20T15:20:07.010", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?old_path=/head-meta-data/tags/20251118&new_path=/head-meta-data/tags/20260105"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9592bb6d-8e1d-4c89-addd-11c07272a628?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-16T02:09:10.579423+00:00", "value": {"mitigation_remediation": ["Upgrade the Head Meta Data plugin to version\u202f20260105 or newer, which implements proper input sanitization and output escaping for the post meta field.", "Disable the plugin entirely if it is not required for site functionality.", "If the plugin must remain active, restrict contributor\u2011level accounts from modifying the head\u2011meta\u2011data field and periodically audit the content for unexpected script injections."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting exploitable by authenticated Contributor+ users"}, "threat_synthesis": {"affected_systems": "WordPress sites that have installed the Head Meta Data plugin from the specialk vendor and are running any version up to and including 20251118 are impacted. The flaw manifests whenever the plugin renders the stored post meta value on a page; thus any page that uses the plugin\u2019s functionality can be used as an injection vector.", "description_and_impact": "The Head Meta Data plugin for WordPress contains a stored cross\u2011site scripting flaw in the \u2018head\u2011meta\u2011data\u2019 post meta field. Owing to missing input sanitization and output escaping, an authenticated user with contributor or higher privileges can inject arbitrary web scripts that are stored and then executed within the browsers of any visitor who loads a page that renders the affected meta field. The vulnerability thus permits the execution of malicious JavaScript in the context of site visitors.", "risk_and_exploitability": "With a CVSS base score of 6.4, the vulnerability is considered moderate. The EPSS score indicates a very low likelihood of exploitation, and the vulnerability is not included in the CISA KEV catalog. Because the attack requires authorised contributor\u2011level or higher access, exploitation depends on the attacker first gaining such privileges within the site. Once injected, the malicious script runs in the visitor\u2019s browser but no further outward impact is described in the public report."}}}}, "created": "2026-01-21T11:19:15.282915+00:00", "updated": "2026-04-16T02:15:21.335171+00:00", "vendors": ["specialk", "specialk$PRODUCT$head_meta_data", "wordpress", "wordpress$PRODUCT$wordpress"]}