CVE-2026-1893

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1893", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-04T14:37:02.315Z", "datePublished": "2026-02-11T04:36:05.805Z", "dateUpdated": "2026-04-08T17:04:29.732Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:04:29.732Z"}, "affected": [{"vendor": "lordspace", "product": "Orbisius Random Name Generator", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Orbisius Random Name Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btn_label' parameter in the 'orbisius_random_name_generator' shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Orbisius Random Name Generator <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'btn_label' Shortcode Attribute", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/84e6bd88-88d1-4529-86f3-6c73fb47db9b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/orbisius-random-name-generator/tags/1.0.2/orbisius-random-name-generator.php#L112"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3455340%40orbisius-random-name-generator&new=3455340%40orbisius-random-name-generator&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Djaidja Moundjid"}], "timeline": [{"time": "2026-02-04T18:15:52.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-02-10T15:58:41.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-11T15:48:47.127599Z", "id": "CVE-2026-1893", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T15:49:26.701Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1893", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-11T15:48:47.127599Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T15:49:12.587Z"}}], "cna": {"title": "Orbisius Random Name Generator <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'btn_label' Shortcode Attribute", "credits": [{"lang": "en", "type": "finder", "value": "Djaidja Moundjid"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "lordspace", "product": "Orbisius Random Name Generator", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.0.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-04T18:15:52.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-02-10T15:58:41.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/84e6bd88-88d1-4529-86f3-6c73fb47db9b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/orbisius-random-name-generator/tags/1.0.2/orbisius-random-name-generator.php#L112"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3455340%40orbisius-random-name-generator&new=3455340%40orbisius-random-name-generator&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Orbisius Random Name Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btn_label' parameter in the 'orbisius_random_name_generator' shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-02-11T04:36:05.805Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1893", "state": "PUBLISHED", "dateUpdated": "2026-02-11T15:49:26.701Z", "dateReserved": "2026-02-04T14:37:02.315Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-11T04:36:05.805Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Orbisius Random Name Generator", "vendor": "lordspace", "versions": [{"lessThanOrEqual": "1.0.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Orbisius Random Name Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btn_label' parameter in the 'orbisius_random_name_generator' shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Orbisius Random Name Generator para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del par\u00e1metro 'btn_label' en el shortcode 'orbisius_random_name_generator' en todas las versiones hasta la 1.0.2, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes autenticados, con acceso de nivel Colaborador y superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2026-1893", "lastModified": "2026-06-17T10:16:40.593", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1893", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-11T15:48:47.127599Z", "version": "2.0.3"}}]}, "published": "2026-02-11T05:16:20.150", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/orbisius-random-name-generator/tags/1.0.2/orbisius-random-name-generator.php#L112"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3455340%40orbisius-random-name-generator&new=3455340%40orbisius-random-name-generator&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/84e6bd88-88d1-4529-86f3-6c73fb47db9b?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.0.2]"}}], "product": "orbisius_random_name_generator", "vendor": "lordspace"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T18:38:11.776038+00:00", "value": {"mitigation_remediation": ["Update the Orbisius Random Name Generator plugin to a version newer than 1.0.2 or apply the vendor\u2011provided patch. ", "Remove or sanitize all occurrences of the 'btn_label' attribute in existing shortcodes, ensuring that any leftover input is properly escaped. ", "Restrict Contributor and above roles from editing shortcodes or consider disabling the shortcode mechanism for sites that cannot immediately upgrade."], "summary": {"action": "Apply Patch", "impact": "Stored XSS"}, "threat_synthesis": {"affected_systems": "All installations of the Orbisius Random Name Generator plugin, versions up to and including 1.0.2, regardless of WordPress version. The vulnerability is present in all affected releases, so any site still running 1.0.2 or older is at risk.", "description_and_impact": "The Orbisius Random Name Generator plugin for WordPress allows authenticated users with Contributor level or higher to inject arbitrary JavaScript through the 'btn_label' attribute of the 'orbisius_random_name_generator' shortcode. By omitting proper input sanitization and output escaping, malicious code is stored in the database and executed whenever a page containing the shortcode is rendered, enabling attackers to compromise the browsing context of any site visitor.", "risk_and_exploitability": "The plugin scores 6.4 on the CVSS scale, indicating moderate severity. The EPSS score is reported as less than 1%, implying a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers must first be authenticated with Contributor or higher privileges, then craft a malicious 'btn_label' value; if successful, the stored script will execute for all users who view the page. This authenticated approach limits the threat surface to users who can access the shortcode editor, but once compromised it can be used to deface or steal user data."}}}}, "created": "2026-02-11T21:46:12.721301+00:00", "updated": "2026-04-15T18:45:11.419485+00:00", "vendors": ["lordspace", "lordspace$PRODUCT$orbisius_random_name_generator", "wordpress", "wordpress$PRODUCT$wordpress"]}