CVE-2026-1047

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1047", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-16T16:29:33.653Z", "datePublished": "2026-02-19T04:36:13.708Z", "dateUpdated": "2026-04-08T16:58:01.163Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:58:01.163Z"}, "affected": [{"vendor": "goback2", "product": "salavat counter Plugin", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "0.9.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The salavat counter Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'image_url' parameter in all versions up to, and including, 0.9.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "salavat counter Plugin <= 0.9.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'image_url' Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6696b262-c6e5-4413-b7dc-894965daa5ac?source=cve"}, {"url": "https://downloads.wordpress.org/plugin/salavat-counter.zip"}, {"url": "https://wordpress.org/plugins/salavat-counter/"}, {"url": "https://plugins.trac.wordpress.org/browser/salavat-counter/tags/0.9.5/wp-table-options.php#L352"}, {"url": "https://plugins.trac.wordpress.org/browser/salavat-counter/trunk/wp-table-options.php#L352"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Bhumividh Treloges"}], "timeline": [{"time": "2026-02-18T15:59:20.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-19T17:03:42.866341Z", "id": "CVE-2026-1047", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T17:36:45.995Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1047", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-19T17:03:42.866341Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T17:03:44.643Z"}}], "cna": {"title": "salavat counter Plugin <= 0.9.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'image_url' Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Bhumividh Treloges"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "goback2", "product": "salavat counter Plugin", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.9.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-18T15:59:20.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6696b262-c6e5-4413-b7dc-894965daa5ac?source=cve"}, {"url": "https://downloads.wordpress.org/plugin/salavat-counter.zip"}, {"url": "https://wordpress.org/plugins/salavat-counter/"}, {"url": "https://plugins.trac.wordpress.org/browser/salavat-counter/tags/0.9.5/wp-table-options.php#L352"}, {"url": "https://plugins.trac.wordpress.org/browser/salavat-counter/trunk/wp-table-options.php#L352"}], "descriptions": [{"lang": "en", "value": "The salavat counter Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'image_url' parameter in all versions up to, and including, 0.9.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:58:01.163Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1047", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:58:01.163Z", "dateReserved": "2026-01-16T16:29:33.653Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-19T04:36:13.708Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "salavat counter Plugin", "vendor": "goback2", "versions": [{"lessThanOrEqual": "0.9.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The salavat counter Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'image_url' parameter in all versions up to, and including, 0.9.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin 'salavat counter Plugin' para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del par\u00e1metro 'image_url' en todas las versiones hasta la 0.9.5, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes autenticados, con acceso de nivel de administrador y superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2026-1047", "lastModified": "2026-06-17T10:14:54.417", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1047", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-19T17:03:42.866341Z", "version": "2.0.3"}}]}, "published": "2026-02-19T07:17:43.377", "references": [{"source": "security@wordfence.com", "url": "https://downloads.wordpress.org/plugin/salavat-counter.zip"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/salavat-counter/tags/0.9.5/wp-table-options.php#L352"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/salavat-counter/trunk/wp-table-options.php#L352"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/salavat-counter/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6696b262-c6e5-4413-b7dc-894965daa5ac?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.9.5]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "salavat counter Plugin", "source": "cna", "vendor": "goback2"}, "product": "salavat_counter_plugin", "vendor": "goback2"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-16T06:44:22.948857+00:00", "value": {"mitigation_remediation": ["Upgrade the salavat counter plugin to version 0.9.6 or later.", "Delete or purge any existing 'image_url' entries that contain malicious code after upgrading.", "Disable or remove the admin interface that allows modification of 'image_url', or uninstall the plugin entirely.", "Implement a Content\u2011Security\u2011Policy header that blocks inline scripts and restricts script sources to trusted origins."], "summary": {"action": "Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "All WordPress sites that have installed the goback2 salavat counter plugin in versions 0.9.5 or earlier are affected. The flaw exists in every release up to and including 0.9.5 because the input handling was never corrected before that version. Sites that removed or disabled the plugin or upgraded beyond that version are no longer impacted.", "description_and_impact": "The salavat counter plugin for WordPress stores an 'image_url' field without adequate sanitization or escaping, allowing a maliciously crafted script to be persisted. Because the plugin accepts this parameter through its admin interface, an attacker who is authenticated with administrator-level privileges can inject arbitrary JavaScript code that will run in the browsers of any user who views a page that displays the stored value. This constitutes a stored cross\u2011site scripting vulnerability, stemming from inadequate input validation and output escaping, and corresponds to CWE\u201179.", "risk_and_exploitability": "The CVSS base score of 4.4 indicates a moderate severity, while an EPSS score of less than 1% suggests a low likelihood of real\u2011world exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker must be authenticated and possess administrator or higher privileges to inject payloads, making the attack vector an authenticated privileged use of the plugin\u2019s admin interface. Once stored, the malicious script runs for every visitor who accesses the affected page, thereby potentially impacting a broad user base."}}}}, "created": "2026-02-19T10:07:12.157631+00:00", "updated": "2026-04-16T06:45:16.321923+00:00", "vendors": ["goback2", "goback2$PRODUCT$salavat_counter_plugin", "wordpress", "wordpress$PRODUCT$wordpress"]}