CVE-2026-0681

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0681", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-07T17:59:41.218Z", "datePublished": "2026-02-04T08:25:29.711Z", "dateUpdated": "2026-04-08T16:54:20.411Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:54:20.411Z"}, "affected": [{"vendor": "rtddev", "product": "Extended Random Number Generator", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Extended Random Number Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "title": "Extended Random Number Generator <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/575c3329-8dbb-4d15-8e11-a86a01b96f50?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/extended-random-number-generator/trunk/random_number_generator.php#L187"}, {"url": "https://plugins.trac.wordpress.org/browser/extended-random-number-generator/tags/1.1/random_number_generator.php#L187"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Bhumividh Treloges"}], "timeline": [{"time": "2026-02-03T19:30:24.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-04T17:01:00.787498Z", "id": "CVE-2026-0681", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T17:01:08.520Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0681", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-04T17:01:00.787498Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T17:01:05.881Z"}}], "cna": {"title": "Extended Random Number Generator <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings", "credits": [{"lang": "en", "type": "finder", "value": "Bhumividh Treloges"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "rtddev", "product": "Extended Random Number Generator", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-03T19:30:24.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/575c3329-8dbb-4d15-8e11-a86a01b96f50?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/extended-random-number-generator/trunk/random_number_generator.php#L187"}, {"url": "https://plugins.trac.wordpress.org/browser/extended-random-number-generator/tags/1.1/random_number_generator.php#L187"}], "descriptions": [{"lang": "en", "value": "The Extended Random Number Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-02-04T08:25:29.711Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0681", "state": "PUBLISHED", "dateUpdated": "2026-02-04T17:01:08.520Z", "dateReserved": "2026-01-07T17:59:41.218Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-04T08:25:29.711Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Extended Random Number Generator", "vendor": "rtddev", "versions": [{"lessThanOrEqual": "1.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Extended Random Number Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}, {"lang": "es", "value": "El plugin Extended Random Number Generator para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s de la configuraci\u00f3n del plugin en todas las versiones hasta la 1.1, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes autenticados, con acceso de nivel de administrador, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada. Esto solo afecta a instalaciones multisitio y a instalaciones donde se ha deshabilitado unfiltered_html."}], "id": "CVE-2026-0681", "lastModified": "2026-06-17T10:11:11.900", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0681", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-04T17:01:00.787498Z", "version": "2.0.3"}}]}, "published": "2026-02-04T09:15:52.313", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/extended-random-number-generator/tags/1.1/random_number_generator.php#L187"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/extended-random-number-generator/trunk/random_number_generator.php#L187"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/575c3329-8dbb-4d15-8e11-a86a01b96f50?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-15T21:28:13.887864+00:00", "value": {"mitigation_remediation": ["Upgrade the Extended Random Number Generator plugin to the latest release that removes the vulnerable input handling.", "Ensure that the unfiltered_html capability is granted only to trusted administrators or disable it entirely on multisite installations.", "Deploy a Web Application Firewall rule or enforce a Content Security Policy that blocks inline scripts from the plugin settings page to mitigate any remaining stored payloads."], "summary": {"action": "Patch", "impact": "Stored XSS"}, "threat_synthesis": {"affected_systems": "The vulnerability affects installations of the rtddev:Extended Random Number Generator plugin on WordPress multisite networks or single\u2011site deployments where the unfiltered_html capability is disabled. The flaw exists in every version from the initial release through 1.1 inclusive, so any user running that version should consider updating. Other WordPress plugins or core components are not directly impacted.", "description_and_impact": "The Extended Random Number Generator plugin for WordPress contains a stored cross\u2011site scripting vulnerability in all releases up to 1.1. Inadequate input sanitization and output escaping in the plugin settings page allows an authenticated user with administrator privileges to inject malicious JavaScript that is stored in the database. When a page that includes that setting is rendered, the injected script executes in the browsers of any visitor, potentially stealing session cookies, defacing content, or bypassing authentication.", "risk_and_exploitability": "With a CVSS v3.1 score of 4.4, the risk is classified as moderate, but the EPSS score is below 1\u202f% and the issue is not listed in CISA\u2019s KEV catalog, indicating a very low probability of public exploitation at present. Successful exploitation requires that the attacker already possesses administrator access and that the target is a multisite configuration with unfiltered_html turned off. Because the flaw is stored, the abuse potential remains as long as the malicious script persists in the settings, so the impact could persist for all users who view affected pages."}}}}, "created": "2026-02-04T21:18:18.624814+00:00", "updated": "2026-04-15T21:30:13.898359+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}