CVE-2026-1914

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1914", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-04T15:39:06.887Z", "datePublished": "2026-03-21T03:27:12.612Z", "dateUpdated": "2026-04-08T17:31:40.520Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:31:40.520Z"}, "affected": [{"vendor": "jeremyshapiro", "product": "FuseDesk", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "6.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The FuseDesk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fusedesk_newcase shortcode in all versions up to, and including, 6.8 due to insufficient input sanitization and output escaping on the 'emailtext' attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "FuseDesk <= 6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'emailtext' Shortcode Attribute", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/edd24cfd-723d-4dc4-a301-43f858dcd7f3?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/fusedesk/trunk/fusedesk.php#L561"}, {"url": "https://plugins.trac.wordpress.org/browser/fusedesk/tags/6.8/fusedesk.php#L561"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Djaidja Moundjid"}], "timeline": [{"time": "2026-03-20T15:13:03.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-23T15:53:01.421460Z", "id": "CVE-2026-1914", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T15:53:11.382Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1914", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-23T15:53:01.421460Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T15:53:06.460Z"}}], "cna": {"title": "FuseDesk <= 6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'emailtext' Shortcode Attribute", "credits": [{"lang": "en", "type": "finder", "value": "Djaidja Moundjid"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "jeremyshapiro", "product": "FuseDesk", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "6.8"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-03-20T15:13:03.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/edd24cfd-723d-4dc4-a301-43f858dcd7f3?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/fusedesk/trunk/fusedesk.php#L561"}, {"url": "https://plugins.trac.wordpress.org/browser/fusedesk/tags/6.8/fusedesk.php#L561"}], "descriptions": [{"lang": "en", "value": "The FuseDesk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fusedesk_newcase shortcode in all versions up to, and including, 6.8 due to insufficient input sanitization and output escaping on the 'emailtext' attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-03-21T03:27:12.612Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1914", "state": "PUBLISHED", "dateUpdated": "2026-03-23T15:53:11.382Z", "dateReserved": "2026-02-04T15:39:06.887Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-21T03:27:12.612Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "FuseDesk", "vendor": "jeremyshapiro", "versions": [{"lessThanOrEqual": "6.8", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The FuseDesk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fusedesk_newcase shortcode in all versions up to, and including, 6.8 due to insufficient input sanitization and output escaping on the 'emailtext' attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin FuseDesk para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s del shortcode fusedesk_newcase del plugin en todas las versiones hasta la 6.8, inclusive, debido a la sanitizaci\u00f3n insuficiente de la entrada y al escape de la salida en el atributo 'emailtext'. Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2026-1914", "lastModified": "2026-06-17T10:16:42.837", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1914", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-23T15:53:01.421460Z", "version": "2.0.3"}}]}, "published": "2026-03-21T04:16:56.617", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/fusedesk/tags/6.8/fusedesk.php#L561"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/fusedesk/trunk/fusedesk.php#L561"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/edd24cfd-723d-4dc4-a301-43f858dcd7f3?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,6.8]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "FuseDesk", "source": "cna", "vendor": "jeremyshapiro"}, "product": "fusedesk", "vendor": "jeremyshapiro"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-21T07:09:38.375876+00:00", "value": {"mitigation_remediation": ["Apply the latest FuseDesk plugin release that removes the vulnerable shortcode handling.", "If updating is not immediately possible, restrict the use of the fusedesk_newcase shortcode to trusted administrators or temporarily disable it.", "Reduce Contributor role privileges to only those essential capabilities and monitor edits to the emailtext field.", "Deploy site\u2011wide security headers, such as Content\u2011Security\u2011Policy, to mitigate the impact of any accidental XSS delivery."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "All WordPress installations that use the FuseDesk plugin from Jeremy Shapiro up to and including version 6.8 are affected. The vulnerability is present in every release of the plugin distributed through that version threshold, regardless of other plugins or themes.", "description_and_impact": "An attacker with Contributor level or higher credentials can insert malicious JavaScript into the \\u2018emailtext\\u2019 attribute of the fusedesk_newcase shortcode. When a page containing this shortcode is viewed, the unsanitized script executes in the visitor\u2019s browser, enabling session hijacking, data theft, or site defacement. The weakness is a classic example of CWE\u201179, reflecting improper output filtering.", "risk_and_exploitability": "With a CVSS score of 6.4 this vulnerability is considered medium\u2011high. The EPSS score is not available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog, so exact exploitation likelihood is uncertain. The requirement for authenticated Contributor access means that sites with many contributors or with permissive role configurations are at higher risk. An attacker can create or edit a case to embed the malicious payload and then lure users to view that page, where the script runs with the visitor\u2019s credentials."}}}}, "created": "2026-03-23T09:49:44.345956+00:00", "updated": "2026-03-25T14:41:23.026783+00:00", "vendors": ["jeremyshapiro", "jeremyshapiro$PRODUCT$fusedesk", "wordpress", "wordpress$PRODUCT$wordpress"]}