CVE-2026-1042

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1042", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-16T15:51:39.122Z", "datePublished": "2026-01-20T05:30:18.112Z", "dateUpdated": "2026-04-08T17:00:59.076Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:00:59.076Z"}, "affected": [{"vendor": "norcross", "product": "WP Hello Bar", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.02", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP Hello Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'digit_one' and 'digit_two' parameters in all versions up to, and including, 1.02 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "WP Hello Bar <= 1.02 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'digit_one' and 'digit_two' Parameters", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/73b55486-adb8-40c6-9113-c98618d9cb00?source=cve"}, {"url": "https://downloads.wordpress.org/plugin/wp-hello-bar.1.02.zip"}, {"url": "https://wordpress.org/plugins/wp-hello-bar/"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-hello-bar/tags/1.02/wp-hello-bar.php#L214"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-hello-bar/tags/1.02/wp-hello-bar.php#L222"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-hello-bar/tags/1.02/wp-hello-bar.php#L152"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Bhumividh Treloges"}], "timeline": [{"time": "2026-01-19T17:06:39.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-20T20:22:58.842300Z", "id": "CVE-2026-1042", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T20:23:34.138Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1042", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-20T20:22:58.842300Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T20:23:21.609Z"}}], "cna": {"title": "WP Hello Bar <= 1.02 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'digit_one' and 'digit_two' Parameters", "credits": [{"lang": "en", "type": "finder", "value": "Bhumividh Treloges"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "norcross", "product": "WP Hello Bar", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.02"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-19T17:06:39.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/73b55486-adb8-40c6-9113-c98618d9cb00?source=cve"}, {"url": "https://downloads.wordpress.org/plugin/wp-hello-bar.1.02.zip"}, {"url": "https://wordpress.org/plugins/wp-hello-bar/"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-hello-bar/tags/1.02/wp-hello-bar.php#L214"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-hello-bar/tags/1.02/wp-hello-bar.php#L222"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-hello-bar/tags/1.02/wp-hello-bar.php#L152"}], "descriptions": [{"lang": "en", "value": "The WP Hello Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'digit_one' and 'digit_two' parameters in all versions up to, and including, 1.02 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:00:59.076Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1042", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:00:59.076Z", "dateReserved": "2026-01-16T15:51:39.122Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-20T05:30:18.112Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WP Hello Bar", "vendor": "norcross", "versions": [{"lessThanOrEqual": "1.02", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Hello Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'digit_one' and 'digit_two' parameters in all versions up to, and including, 1.02 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin WP Hello Bar para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s de los par\u00e1metros 'digit_one' y 'digit_two' en todas las versiones hasta la 1.02, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes autenticados, con acceso de nivel de administrador y superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2026-1042", "lastModified": "2026-06-17T10:14:53.800", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1042", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-20T20:22:58.842300Z", "version": "2.0.3"}}]}, "published": "2026-01-20T06:16:00.477", "references": [{"source": "security@wordfence.com", "url": "https://downloads.wordpress.org/plugin/wp-hello-bar.1.02.zip"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-hello-bar/tags/1.02/wp-hello-bar.php#L152"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-hello-bar/tags/1.02/wp-hello-bar.php#L214"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-hello-bar/tags/1.02/wp-hello-bar.php#L222"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/wp-hello-bar/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/73b55486-adb8-40c6-9113-c98618d9cb00?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-15T19:08:58.229830+00:00", "value": {"mitigation_remediation": ["Upgrade the WP Hello Bar plugin to a version newer than 1.02. If a newer release is unavailable, remove or disable the plugin entirely to eliminate the vulnerable input fields.", "Sanitize or clear any existing data stored in the 'digit_one' and 'digit_two' fields in the WordPress database to remove previously injected scripts.", "Implement site\u2011wide output escaping and a content\u2011security\u2011policy header to mitigate the impact of any remaining XSS vectors in the plugin."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The vulnerability affects any WordPress installation running the WP Hello Bar plugin up to and including version 1.02, distributed by Norcross. Sites that have installed this version, either directly from the WordPress plugin repository or via the provided zip archive, are susceptible. All users of such installations are potentially exposed if the plugin\u2019s forms are used.", "description_and_impact": "The WP Hello Bar plugin allows authenticated users with administrator privileges to insert arbitrary scripts via the 'digit_one' and 'digit_two' input parameters. Because the plugin does not sanitize or escape these fields upon output, the injected scripts become stored XSS payloads that execute whenever any user loads a page containing the affected data. This flaw enables attackers to compromise the browsers of site visitors and potentially steal credentials or perform other malicious actions.", "risk_and_exploitability": "The CVSS score is 4.4, indicating moderate severity, and the EPSS score is below 1\u202f%, suggesting a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers must possess administrator-level access to the WordPress site to inject the malicious payload, but once injected the script runs in any visitor\u2019s browser regardless of authentication. The combination of limited privilege requirements and the ability to persistently affect users raises the overall risk level for environments running the affected plugin version."}}}}, "created": "2026-01-20T08:40:05.308846+00:00", "updated": "2026-04-15T19:15:12.080355+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}