CVE-2026-1295

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1295", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-21T17:12:45.447Z", "datePublished": "2026-01-28T06:43:43.151Z", "dateUpdated": "2026-04-08T17:05:10.449Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:05:10.449Z"}, "affected": [{"vendor": "supercleanse", "product": "Buy Now Plus \u2014 Payments with Stripe", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Buy Now Plus \u2013 Buy Now buttons for Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buynowplus' shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping on shortcode attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Buy Now Plus <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/87d228bb-eb5b-44ca-91f7-ada730635a3f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/buy-now-plus/tags/1.0.2/class-bnp-buttons.php#L17"}, {"url": "https://plugins.trac.wordpress.org/browser/buy-now-plus/tags/1.0.2/class-bnp-buttons.php#L36"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3444416%40buy-now-plus&new=3444416%40buy-now-plus&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Youcef Hamdani"}], "timeline": [{"time": "2026-01-27T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-28T14:59:19.098664Z", "id": "CVE-2026-1295", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-28T15:00:15.494Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1295", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-28T14:59:19.098664Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-28T15:00:09.285Z"}}], "cna": {"title": "Buy Now Plus <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes", "credits": [{"lang": "en", "type": "finder", "value": "Youcef Hamdani"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "supercleanse", "product": "Buy Now Plus \u2014 Payments with Stripe", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-27T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/87d228bb-eb5b-44ca-91f7-ada730635a3f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/buy-now-plus/tags/1.0.2/class-bnp-buttons.php#L17"}, {"url": "https://plugins.trac.wordpress.org/browser/buy-now-plus/tags/1.0.2/class-bnp-buttons.php#L36"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3444416%40buy-now-plus&new=3444416%40buy-now-plus&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Buy Now Plus \u2013 Buy Now buttons for Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buynowplus' shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping on shortcode attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:05:10.449Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1295", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:05:10.449Z", "dateReserved": "2026-01-21T17:12:45.447Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-28T06:43:43.151Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Buy Now Plus \u2014 Payments with Stripe", "vendor": "supercleanse", "versions": [{"lessThanOrEqual": "1.0.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Buy Now Plus \u2013 Buy Now buttons for Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buynowplus' shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping on shortcode attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Buy Now Plus \u2013 Buy Now buttons para Stripe para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del shortcode 'buynowplus' en todas las versiones hasta la 1.0.2, inclusive, debido a una sanitizaci\u00f3n de entrada y escape de salida insuficientes en los atributos del shortcode. Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador o superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2026-1295", "lastModified": "2026-06-17T10:15:28.227", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1295", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-28T14:59:19.098664Z", "version": "2.0.3"}}]}, "published": "2026-01-28T07:16:00.693", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/buy-now-plus/tags/1.0.2/class-bnp-buttons.php#L17"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/buy-now-plus/tags/1.0.2/class-bnp-buttons.php#L36"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3444416%40buy-now-plus&new=3444416%40buy-now-plus&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/87d228bb-eb5b-44ca-91f7-ada730635a3f?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-15T19:00:25.313647+00:00", "value": {"mitigation_remediation": ["Upgrade the Buy\u202fNow\u202fPlus plugin to a version newer than 1.0.2 that implements proper input sanitization and output escaping for shortcode attributes.", "Confirm that the updated plugin no longer stores raw or unsanitized shortcode attributes in the database.", "Restrict Contributor or higher roles to trusted users only; if the site does not rely on contributors to insert shortcodes, revoke the permission or remove the contributor role entirely."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting that allows authenticated contributors to inject and execute arbitrary scripts when a page containing the vulnerable shortcode is viewed"}, "threat_synthesis": {"affected_systems": "The vulnerability exists in the WordPress plugin Buy\u202fNow\u202fPlus from supercleanse, in all releases up to and including version\u202f1.0.2. Users with Contributor or higher permissions on the affected WordPress site can create the malicious input.", "description_and_impact": "In the Buy Now Plus plugin, the shortcode attributes are not properly sanitized or escaped, enabling a stored XSS flaw. An authenticated attacker who can add or edit content with Contributor-level access can embed malicious script code in the shortcode. Whenever a visitor loads a page that includes the injected shortcode, the attacker's script runs in that visitor\u2019s browser context, potentially stealing cookies, hijacking sessions, or performing actions on behalf of the authenticated user. The flaw affects the confidentiality, integrity, and availability of all site visitors who view the affected content.", "risk_and_exploitability": "The CVSS score of 6.4 indicates moderate risk, while the EPSS score of less than 1\u202f% suggests a low likelihood of exploitation at this time. The flaw is not currently listed in CISA\u2019s KEV catalog. An attacker would need to first authenticate as a Contributor or higher and modify content using the plugin\u2019s shortcode functionality; no privilege escalation or network external attack is required. Because the impact is limited to users who view the compromised content, the attacker benefits mainly from user compromise rather than system compromise."}}}}, "created": "2026-01-29T09:18:12.733503+00:00", "updated": "2026-04-15T19:15:12.062506+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}