CVE-2026-2121

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2121", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-06T14:51:04.441Z", "datePublished": "2026-03-21T03:27:10.972Z", "dateUpdated": "2026-04-08T17:28:48.293Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:28:48.293Z"}, "affected": [{"vendor": "wpweaver", "product": "Weaver Show Posts", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.8.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Weaver Show Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'add_class' parameter in all versions up to, and including, 1.8.1. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This primarily affects multisite installations where Administrators do not have the unfiltered_html capability."}], "title": "Weaver Show Posts <= 1.8.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Additional Classes to Wrap Posts' Widget Setting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e0d525ab-a86d-4750-9d16-731cbc0a626e?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/show-posts/trunk/includes/posts-widgets.php#L32"}, {"url": "https://plugins.trac.wordpress.org/browser/show-posts/tags/1.8.1/includes/posts-widgets.php#L32"}, {"url": "https://plugins.trac.wordpress.org/browser/show-posts/trunk/includes/posts-widgets.php#L45"}, {"url": "https://plugins.trac.wordpress.org/browser/show-posts/tags/1.8.1/includes/posts-widgets.php#L45"}, {"url": "https://youtu.be/kbSqUuEAyho"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muqsith Barru"}], "timeline": [{"time": "2026-02-25T21:25:04.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-03-20T15:17:17.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-24T13:58:19.455475Z", "id": "CVE-2026-2121", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T13:58:28.389Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2121", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-24T13:58:19.455475Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T13:58:24.440Z"}}], "cna": {"title": "Weaver Show Posts <= 1.8.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Additional Classes to Wrap Posts' Widget Setting", "credits": [{"lang": "en", "type": "finder", "value": "Muqsith Barru"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "wpweaver", "product": "Weaver Show Posts", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.8.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-25T21:25:04.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-03-20T15:17:17.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e0d525ab-a86d-4750-9d16-731cbc0a626e?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/show-posts/trunk/includes/posts-widgets.php#L32"}, {"url": "https://plugins.trac.wordpress.org/browser/show-posts/tags/1.8.1/includes/posts-widgets.php#L32"}, {"url": "https://plugins.trac.wordpress.org/browser/show-posts/trunk/includes/posts-widgets.php#L45"}, {"url": "https://plugins.trac.wordpress.org/browser/show-posts/tags/1.8.1/includes/posts-widgets.php#L45"}, {"url": "https://youtu.be/kbSqUuEAyho"}], "descriptions": [{"lang": "en", "value": "The Weaver Show Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'add_class' parameter in all versions up to, and including, 1.8.1. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This primarily affects multisite installations where Administrators do not have the unfiltered_html capability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:28:48.293Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2121", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:28:48.293Z", "dateReserved": "2026-02-06T14:51:04.441Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-21T03:27:10.972Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Weaver Show Posts", "vendor": "wpweaver", "versions": [{"lessThanOrEqual": "1.8.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Weaver Show Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'add_class' parameter in all versions up to, and including, 1.8.1. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This primarily affects multisite installations where Administrators do not have the unfiltered_html capability."}, {"lang": "es", "value": "El plugin Weaver Show Posts para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s del par\u00e1metro 'add_class' en todas las versiones hasta la 1.8.1, inclusive. Esto se debe a una sanitizaci\u00f3n de entrada insuficiente y un escape de salida inadecuado en los atributos proporcionados por el usuario. Esto hace posible que atacantes autenticados, con acceso de nivel de Administrador y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada. Esto afecta principalmente a instalaciones multisitio donde los Administradores no tienen la capacidad unfiltered_html."}], "id": "CVE-2026-2121", "lastModified": "2026-06-17T10:30:21.490", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2121", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-24T13:58:19.455475Z", "version": "2.0.3"}}]}, "published": "2026-03-21T04:16:57.603", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/show-posts/tags/1.8.1/includes/posts-widgets.php#L32"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/show-posts/tags/1.8.1/includes/posts-widgets.php#L45"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/show-posts/trunk/includes/posts-widgets.php#L32"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/show-posts/trunk/includes/posts-widgets.php#L45"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e0d525ab-a86d-4750-9d16-731cbc0a626e?source=cve"}, {"source": "security@wordfence.com", "url": "https://youtu.be/kbSqUuEAyho"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.8.1]"}}], "enrichment": {"confidence": 87.0, "confidence_source": "matching", "scores": [{"score": 87.0, "source": "matching"}]}, "original": {"product": "Weaver Show Posts", "source": "cna", "vendor": "wpweaver"}, "product": "weaver_show_posts", "vendor": "weavertheme"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-21T06:36:29.991911+00:00", "value": {"mitigation_remediation": ["Upgrade Weaver Show Posts to the latest release (\u22651.8.2) to eliminate the flaw. ", "If an upgrade cannot be performed, disable or remove the Additional Classes to Wrap Posts widget or clear the add_class setting. ", "Restrict widget configuration access to super\u2011administrators and ensure administrators lack the unfiltered_html capability. ", "Verify that the plugin is no longer loaded on the front\u2011end of the site until a patch is applied."], "summary": {"action": "Patch Now", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "Any WordPress site running the Weaver Show Posts plugin version 1.8.1 or earlier is affected. The issue is present in all releases up to and including 1.8.1. Multisite installations are particularly vulnerable when site administrators do not have the unfiltered_html capability, because the flaw is triggered by administrators with elevated privileges.", "description_and_impact": "The Weaver Show Posts plugin suffers from a stored cross\u2011site scripting flaw that allows an administrator to embed arbitrary JavaScript into the widget\u2019s additional classes parameter. Because user input is neither sanitized nor escaped, the injected script is rendered and executed whenever a page containing the widget is viewed by any visitor. This vulnerability can be used to hijack user sessions, deface content, or distribute malware. The weakness is a classic cross\u2011site scripting type flaw.", "risk_and_exploitability": "The CVSS v3.1 score of 4.4 indicates moderate risk. Exploit probability details are not available, and the vulnerability is not listed in CISA\u2019s KEV catalog. An attacker must first obtain administrator level or higher credentials to inject payloads; once logged in, the stored script can affect all page views of affected sites, potentially compromising confidentiality and integrity for all users."}}}}, "created": "2026-03-23T09:49:47.905109+00:00", "updated": "2026-03-25T14:41:27.329030+00:00", "vendors": ["weavertheme", "weavertheme$PRODUCT$weaver_show_posts", "wordpress", "wordpress$PRODUCT$wordpress"]}