CVE-2026-0691

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0691", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-07T20:54:14.552Z", "datePublished": "2026-01-17T06:42:20.210Z", "dateUpdated": "2026-04-08T17:03:54.008Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:03:54.008Z"}, "affected": [{"vendor": "creativemindssolutions", "product": "CM E-Mail Blacklist \u2013 Simple email filtering for safer registration", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.6.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The CM E-Mail Blacklist \u2013 Simple email filtering for safer registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'black_email' parameter in all versions up to, and including, 1.6.2. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "title": "CM E-Mail Blacklist <= 1.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'black_email' Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/821f4ea9-bc25-4d65-9058-5b77c4f1b230?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/cm-email-blacklist/trunk/backend/views/settings/email_blacklist.phtml#L67"}, {"url": "https://plugins.trac.wordpress.org/browser/cm-email-blacklist/tags/1.6.2/backend/views/settings/email_blacklist.phtml#L67"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3440158%40cm-email-blacklist&new=3440158%40cm-email-blacklist&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Phap Nguyen Anh"}], "timeline": [{"time": "2026-01-07T21:09:24.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-16T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-20T18:28:29.618825Z", "id": "CVE-2026-0691", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T18:28:47.071Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0691", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-20T18:28:29.618825Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T18:28:42.380Z"}}], "cna": {"title": "CM E-Mail Blacklist <= 1.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'black_email' Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Phap Nguyen Anh"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "creativemindssolutions", "product": "CM E-Mail Blacklist \u2013 Simple email filtering for safer registration", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.6.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-07T21:09:24.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-16T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/821f4ea9-bc25-4d65-9058-5b77c4f1b230?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/cm-email-blacklist/trunk/backend/views/settings/email_blacklist.phtml#L67"}, {"url": "https://plugins.trac.wordpress.org/browser/cm-email-blacklist/tags/1.6.2/backend/views/settings/email_blacklist.phtml#L67"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3440158%40cm-email-blacklist&new=3440158%40cm-email-blacklist&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The CM E-Mail Blacklist \u2013 Simple email filtering for safer registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'black_email' parameter in all versions up to, and including, 1.6.2. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:03:54.008Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0691", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:03:54.008Z", "dateReserved": "2026-01-07T20:54:14.552Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-17T06:42:20.210Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "CM E-Mail Blacklist \u2013 Simple email filtering for safer registration", "vendor": "creativemindssolutions", "versions": [{"lessThanOrEqual": "1.6.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The CM E-Mail Blacklist \u2013 Simple email filtering for safer registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'black_email' parameter in all versions up to, and including, 1.6.2. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}, {"lang": "es", "value": "El plugin CM E-Mail Blacklist \u2013 Simple email filtering para safer registration para WordPress es vulnerable a Stored Cross-Site Scripting a trav\u00e9s del par\u00e1metro 'black_email' en todas las versiones hasta la 1.6.2, inclusive. Esto se debe a una sanitizaci\u00f3n de entrada insuficiente y un escape de salida deficiente. Esto hace posible que atacantes autenticados, con acceso de nivel de administrador y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada. Esto solo afecta a instalaciones multisitio y a instalaciones donde unfiltered_html ha sido deshabilitado."}], "id": "CVE-2026-0691", "lastModified": "2026-06-17T10:11:12.823", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0691", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-20T18:28:29.618825Z", "version": "2.0.3"}}]}, "published": "2026-01-17T07:16:01.933", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/cm-email-blacklist/tags/1.6.2/backend/views/settings/email_blacklist.phtml#L67"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/cm-email-blacklist/trunk/backend/views/settings/email_blacklist.phtml#L67"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3440158%40cm-email-blacklist&new=3440158%40cm-email-blacklist&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/821f4ea9-bc25-4d65-9058-5b77c4f1b230?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-15T21:45:51.545458+00:00", "value": {"mitigation_remediation": ["Upgrade CM E-Mail Blacklist to the latest stable release (>=1.6.3) that removes the vulnerable code path.", "If upgrading immediately is not feasible, restrict the plugin to single\u2011site operations, or disable the 'unfiltered_html' capability for all users, thereby preventing the stored script from being rendered.", "Implement a web application firewall or security plugin such as WordFence to detect and block malicious script injections targeting the 'black_email' field."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The affected product is the CM E-Mail Blacklist \u2013 Simple email filtering plugin made by Creative Minds Solutions. Versions up to and including 1.6.2 are vulnerable. The flaw is confined to WordPress installations that are running in multi\u2011site mode and that have the \u2018unfiltered_html\u2019 feature disabled. The plugin is typically used on WordPress sites, and the issue arises whenever an administrator edits the blacklist via the plugin\u2019s settings page.", "description_and_impact": "The vulnerability lies in the CM E-Mail Blacklist \u2013 Simple email filtering plugin for WordPress. It allows an attacker with administrator\u2011level privileges to inject arbitrary JavaScript into the \u2018black_email\u2019 input field, which is stored by the plugin. Because the input is not properly sanitized or escaped, the stored script will execute in the browser whenever any user visits a page that displays that data. This constitutes a stored cross\u2011site scripting flaw that could let attackers hijack user sessions, deface content, or spread malware, all contingent on the attacker succeeding in directing victims to the injected page.", "risk_and_exploitability": "The CVSS score of 4.4 indicates a moderate severity, and the EPSS score of <1% shows that the likelihood of exploitation is very low at present. The vulnerability does not appear in the CISA KEV catalog, which further suggests it is not currently being actively exploited. However, the flaw requires that an attacker already has administrator access on a multi\u2011site WordPress installation, and the stored payload will only execute when users open the affected page. Potential attackers would therefore need to compromise a site\u2019s admin account or leverage social engineering to gain such access before exploiting the XSS vector."}}}}, "created": "2026-01-19T09:19:21.105078+00:00", "updated": "2026-04-15T22:00:06.622493+00:00", "vendors": ["creativemindssolutions", "creativemindssolutions$PRODUCT$cm_e-mail_blacklist_\u2013_simple_email_filtering_for_safer_registration", "wordpress", "wordpress$PRODUCT$wordpress"]}