CVE-2026-2289

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2289", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-10T15:17:13.447Z", "datePublished": "2026-03-04T01:21:58.529Z", "dateUpdated": "2026-04-08T17:03:49.700Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:03:49.700Z"}, "affected": [{"vendor": "taskbuilder", "product": "Taskbuilder \u2013 Project Management & Task Management Tool With Kanban Board", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.0.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Taskbuilder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "title": "Taskbuilder <= 5.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Block Emails' Field", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/81e26924-c9eb-4ddf-89e3-a8bf95d23b78?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/taskbuilder/trunk/includes/admin/email_notifications/wppm_get_en_general_setting.php#L30"}, {"url": "https://plugins.trac.wordpress.org/browser/taskbuilder/tags/5.0.1/includes/admin/email_notifications/wppm_get_en_general_setting.php#L30"}, {"url": "https://plugins.trac.wordpress.org/browser/taskbuilder/trunk/includes/class-wppm-functions.php#L19"}, {"url": "https://plugins.trac.wordpress.org/browser/taskbuilder/tags/5.0.1/includes/class-wppm-functions.php#L19"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3468819%40taskbuilder&new=3468819%40taskbuilder&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Phap Nguyen Anh"}], "timeline": [{"time": "2026-02-10T15:32:28.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-03-03T12:40:33.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-04T16:08:10.331800Z", "id": "CVE-2026-2289", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T16:08:22.933Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2289", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-04T16:08:10.331800Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T16:08:18.077Z"}}], "cna": {"title": "Taskbuilder <= 5.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Block Emails' Field", "credits": [{"lang": "en", "type": "finder", "value": "Phap Nguyen Anh"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "taskbuilder", "product": "Taskbuilder \u2013 Project Management & Task Management Tool With Kanban Board", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.0.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-10T15:32:28.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-03-03T12:40:33.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/81e26924-c9eb-4ddf-89e3-a8bf95d23b78?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/taskbuilder/trunk/includes/admin/email_notifications/wppm_get_en_general_setting.php#L30"}, {"url": "https://plugins.trac.wordpress.org/browser/taskbuilder/tags/5.0.1/includes/admin/email_notifications/wppm_get_en_general_setting.php#L30"}, {"url": "https://plugins.trac.wordpress.org/browser/taskbuilder/trunk/includes/class-wppm-functions.php#L19"}, {"url": "https://plugins.trac.wordpress.org/browser/taskbuilder/tags/5.0.1/includes/class-wppm-functions.php#L19"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3468819%40taskbuilder&new=3468819%40taskbuilder&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Taskbuilder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:03:49.700Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2289", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:03:49.700Z", "dateReserved": "2026-02-10T15:17:13.447Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-04T01:21:58.529Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Taskbuilder \u2013 Project Management & Task Management Tool With Kanban Board", "vendor": "taskbuilder", "versions": [{"lessThanOrEqual": "5.0.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Taskbuilder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}, {"lang": "es", "value": "El plugin Taskbuilder para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s de la configuraci\u00f3n de administrador en todas las versiones hasta la 5.0.3, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto hace posible que atacantes autenticados, con permisos de nivel de administrador y superiores, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada. Esto solo afecta a instalaciones multisitio y a instalaciones donde unfiltered_html ha sido deshabilitado."}], "id": "CVE-2026-2289", "lastModified": "2026-06-17T10:30:43.707", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2289", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-04T16:08:10.331800Z", "version": "2.0.3"}}]}, "published": "2026-03-04T02:15:54.317", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/taskbuilder/tags/5.0.1/includes/admin/email_notifications/wppm_get_en_general_setting.php#L30"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/taskbuilder/tags/5.0.1/includes/class-wppm-functions.php#L19"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/taskbuilder/trunk/includes/admin/email_notifications/wppm_get_en_general_setting.php#L30"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/taskbuilder/trunk/includes/class-wppm-functions.php#L19"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3468819%40taskbuilder&new=3468819%40taskbuilder&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/81e26924-c9eb-4ddf-89e3-a8bf95d23b78?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.0.3]"}}], "enrichment": {"confidence": 83.0, "confidence_source": "matching", "scores": [{"score": 83.0, "source": "matching"}]}, "original": {"product": "Taskbuilder \u2013 Project Management & Task Management Tool With Kanban Board", "source": "cna", "vendor": "taskbuilder"}, "product": "taskbuilder_\u2013_wordpress_project_management_&_task_management,kanban_view", "vendor": "taskbuilder"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T20:05:15.096477+00:00", "value": {"mitigation_remediation": ["Upgrade the Taskbuilder plugin to the latest available version (5.0.4 or newer) which includes proper input sanitization and output escaping for the Block Emails field.", "If upgrading is not immediately possible, clear the contents of the Block Emails field or edit the database value to remove any injected scripts before the setting is rendered; this eliminates the stored payload.", "Restrict access to the task settings page to trusted administrators only and consider disabling unfiltered_html on multisite installations unless absolutely required."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting caused by administrator input"}, "threat_synthesis": {"affected_systems": "Taskbuilder \u2013 Project Management & Task Management Tool With Kanban Board, all versions up to and including 5.0.3. Any WordPress site that has not yet applied the update is affected.", "description_and_impact": "The Taskbuilder plugin for WordPress suffers from a stored cross\u2011site scripting flaw whereby an administrator\u2011level user can inject malicious JavaScript into the \u2018Block Emails\u2019 setting. The injected script is rendered in later emails or pages viewed by other users, leading to purely client\u2011side code execution on those browsers. Because the vulnerability requires authenticated administrator access and is only present when unfiltered_html is disabled on multisite installs, it does not provide remote code execution but can compromise user credentials or enable phishing attacks.", "risk_and_exploitability": "The CVSS score of 4.4 reflects a moderate risk, and an EPSS score below 1% indicates that exploitation is unlikely at this time. It is not listed in the CISA KEV catalog. The attack vector is inferred to be a web\u2011based interaction with the plugin\u2019s admin interface, where the attacker can edit the block emails setting. Because the defect requires administrator privileges, the scope is limited to users with those roles, but the affected users may suffer session hijacking, credential theft, or phishing if the injected scripts read cookies or forge requests."}}}}, "created": "2026-03-04T14:53:26.388100+00:00", "updated": "2026-04-15T20:15:13.711065+00:00", "vendors": ["taskbuilder", "taskbuilder$PRODUCT$taskbuilder_\u2013_wordpress_project_management_&_task_management,kanban_view", "wordpress", "wordpress$PRODUCT$wordpress"]}