CVE-2026-1187

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1187", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-19T13:33:12.755Z", "datePublished": "2026-02-14T06:42:36.502Z", "dateUpdated": "2026-04-08T17:32:33.773Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:32:33.773Z"}, "affected": [{"vendor": "terrazoom", "product": "ZoomifyWP Free", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The ZoomifyWP Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'filename' parameter of the 'zoomify' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "ZoomifyWP Free <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'filename' Shortcode Attribute", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f1fa59e0-c946-40d3-a817-c9924b4588fa?source=cve"}, {"url": "https://wordpress.org/plugins/tz-zoomifywp-free/"}, {"url": "https://plugins.trac.wordpress.org/browser/tz-zoomifywp-free/trunk/zoomifyWP-free.php#L54"}, {"url": "https://plugins.trac.wordpress.org/browser/tz-zoomifywp-free/tags/1.1/zoomifyWP-free.php#L54"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Youcef Hamdani"}], "timeline": [{"time": "2026-02-13T18:18:18.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-17T21:19:12.979672Z", "id": "CVE-2026-1187", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T21:19:25.969Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1187", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-17T21:19:12.979672Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T21:19:20.256Z"}}], "cna": {"title": "ZoomifyWP Free <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'filename' Shortcode Attribute", "credits": [{"lang": "en", "type": "finder", "value": "Youcef Hamdani"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "terrazoom", "product": "ZoomifyWP Free", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-13T18:18:18.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f1fa59e0-c946-40d3-a817-c9924b4588fa?source=cve"}, {"url": "https://wordpress.org/plugins/tz-zoomifywp-free/"}, {"url": "https://plugins.trac.wordpress.org/browser/tz-zoomifywp-free/trunk/zoomifyWP-free.php#L54"}, {"url": "https://plugins.trac.wordpress.org/browser/tz-zoomifywp-free/tags/1.1/zoomifyWP-free.php#L54"}], "descriptions": [{"lang": "en", "value": "The ZoomifyWP Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'filename' parameter of the 'zoomify' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:32:33.773Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1187", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:32:33.773Z", "dateReserved": "2026-01-19T13:33:12.755Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-14T06:42:36.502Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "ZoomifyWP Free", "vendor": "terrazoom", "versions": [{"lessThanOrEqual": "1.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The ZoomifyWP Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'filename' parameter of the 'zoomify' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin ZoomifyWP Free para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del par\u00e1metro 'filename' del shortcode 'zoomify' en todas las versiones hasta la 1.1, inclusive, debido a la sanitizaci\u00f3n insuficiente de la entrada y al escape de la salida en los atributos proporcionados por el usuario. Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2026-1187", "lastModified": "2026-06-17T10:15:17.657", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1187", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-17T21:19:12.979672Z", "version": "2.0.3"}}]}, "published": "2026-02-14T07:16:09.800", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/tz-zoomifywp-free/tags/1.1/zoomifyWP-free.php#L54"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/tz-zoomifywp-free/trunk/zoomifyWP-free.php#L54"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/tz-zoomifywp-free/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f1fa59e0-c946-40d3-a817-c9924b4588fa?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.1]"}}], "product": "zoomifywp_free", "vendor": "terrazoom"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-16T00:46:32.292093+00:00", "value": {"mitigation_remediation": ["Upgrade ZoomifyWP Free to a version newer than 1.1 that includes a fix for the shortcode sanitization.", "If an upgrade is not immediately possible, restrict the use of the 'zoomify' shortcode by Contributor accounts or remove the shortcode from existing content.", "Implement server\u2011side validation and sanitization for shortcode attributes, such as applying wp_kses to ensure no executable script code can be stored."], "summary": {"action": "Update Plugin", "impact": "Stored Cross\u2011Site Scripting that allows an authenticated contributor to inject scripts that execute when visitors load a page"}, "threat_synthesis": {"affected_systems": "WordPress installations that use Terrazoom's ZoomifyWP Free plugin version 1.1 or earlier are affected. The vulnerability exists in every instance of the plugin with those versions where contributors can add or edit post content.", "description_and_impact": "The ZoomifyWP Free plugin contains a flaw where the 'filename' attribute of the 'zoomify' shortcode is not properly sanitized or escaped, enabling an authenticated user with Contributor or higher privileges to store arbitrary scripts in post content. These scripts are executed in visitors\u2019 browsers whenever the affected page is accessed.", "risk_and_exploitability": "The base CVSS score is 6.4, categorizing the issue as moderate severity. The EPSS score is less than 1\u202f%, indicating a very low current probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with at least Contributor level access; once a malicious script is stored via the shortcode, it automatically executes for any visitor loading the affected page, making all site users vulnerable to the stored XSS content."}}}}, "created": "2026-02-16T12:02:01.131835+00:00", "updated": "2026-04-16T01:00:19.946502+00:00", "vendors": ["terrazoom", "terrazoom$PRODUCT$zoomifywp_free", "wordpress", "wordpress$PRODUCT$wordpress"]}