CVE-2026-2432

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2432", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-12T21:17:51.101Z", "datePublished": "2026-03-20T08:25:58.769Z", "dateUpdated": "2026-04-08T17:30:09.320Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:30:09.320Z"}, "affected": [{"vendor": "creativemindssolutions", "product": "CM Custom Reports \u2013 Flexible reporting to track what matters most", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.2.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The CM Custom Reports \u2013 Flexible reporting to track what matters most plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "title": "CM Custom Reports <= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Labels", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e642b5e1-62c1-4aa9-b579-6b2338227dd5?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/cm-custom-reports/trunk/backend/classes/modules/GraphModule.php#L151"}, {"url": "https://plugins.trac.wordpress.org/browser/cm-custom-reports/tags/1.2.7/backend/classes/modules/GraphModule.php#L151"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3464005%40cm-custom-reports&new=3464005%40cm-custom-reports&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "san6051"}], "timeline": [{"time": "2026-02-12T21:33:02.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-03-19T19:57:41.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2432", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-20T15:15:52.167083Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-20T15:23:02.640Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2432", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-12T21:17:51.101Z", "datePublished": "2026-03-20T08:25:58.769Z", "dateUpdated": "2026-03-20T08:25:58.769Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-03-20T08:25:58.769Z"}, "affected": [{"vendor": "creativemindssolutions", "product": "CM Custom Reports \u2013 Flexible reporting to track what matters most", "versions": [{"version": "*", "status": "affected", "lessThanOrEqual": "1.2.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The CM Custom Reports \u2013 Flexible reporting to track what matters most plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "title": "CM Custom Reports <= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Labels", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e642b5e1-62c1-4aa9-b579-6b2338227dd5?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/cm-custom-reports/trunk/backend/classes/modules/GraphModule.php#L151"}, {"url": "https://plugins.trac.wordpress.org/browser/cm-custom-reports/tags/1.2.7/backend/classes/modules/GraphModule.php#L151"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3464005%40cm-custom-reports&new=3464005%40cm-custom-reports&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "san6051"}], "timeline": [{"time": "2026-02-12T21:33:02.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-03-19T19:57:41.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2432", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-20T15:15:52.167083Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-03-20T15:17:46.249Z"}, "title": "CISA ADP Vulnrichment"}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "CM Custom Reports \u2013 Flexible reporting to track what matters most", "vendor": "creativemindssolutions", "versions": [{"lessThanOrEqual": "1.2.7", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The CM Custom Reports \u2013 Flexible reporting to track what matters most plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}, {"lang": "es", "value": "El plugin CM Custom Reports \u2013 Flexible reporting to track what matters most para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s de la configuraci\u00f3n de administrador en todas las versiones hasta la 1.2.7, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto permite que atacantes autenticados, con permisos de nivel de administrador y superiores, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada. Esto solo afecta a instalaciones multisitio e instalaciones donde se ha deshabilitado unfiltered_html."}], "id": "CVE-2026-2432", "lastModified": "2026-06-17T10:30:56.740", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2432", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-20T15:15:52.167083Z", "version": "2.0.3"}}]}, "published": "2026-03-20T09:16:14.327", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/cm-custom-reports/tags/1.2.7/backend/classes/modules/GraphModule.php#L151"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/cm-custom-reports/trunk/backend/classes/modules/GraphModule.php#L151"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3464005%40cm-custom-reports&new=3464005%40cm-custom-reports&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e642b5e1-62c1-4aa9-b579-6b2338227dd5?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.2.7]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "CM Custom Reports \u2013 Flexible reporting to track what matters most", "source": "cna", "vendor": "creativemindssolutions"}, "product": "cm_custom_reports_\u2013_flexible_reporting_to_track_what_matters_most", "vendor": "creativemindssolutions"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-20T09:50:48.275487+00:00", "value": {"mitigation_remediation": ["Update the CM Custom Reports plugin to a version newer than 1.2.7", "If an update is not available, deactivate or uninstall the CM Custom Reports plugin to eliminate the vulnerable code", "Restrict administrator\u2011level accounts to only those necessary", "Monitor dashboards and reports for unexpected scripts or injected content", "Implement a content security policy that disallows inline scripts to mitigate the impact of any remaining vulnerabilities"], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "Creative Minds Solutions; All installations of the CM Custom Reports plugin up to and including version\u202f1.2.7 are affected. The vulnerability exists only on multi\u2011site WordPress installations where the unfiltered_html capability is disabled, and requires that an authenticated administrator has access to the plugin\u2019s admin settings.", "description_and_impact": "The CM Custom Reports \u2013 Flexible reporting to track what matters most plugin for WordPress contains a stored XSS flaw. Key detail from vendor description: \"The CM Custom Reports \u2013 Flexible reporting to track what matters most plugin for WordPress is vulnerable to Stored Cross\u2011Site Scripting via admin settings in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping.\" An attacker with administrator\u2011level permissions can inject arbitrary web scripts into plugin settings that will execute whenever a user accesses an injected page. This allows session hijacking, credential theft, or defacement of reports and dashboard pages.", "risk_and_exploitability": "The CVSS score of 4.4 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated administrator\u2011level access and insertion of malicious code via the plugin\u2019s label field. The attack vector is internal to the site but can impact all users who view reports, potentially compromising confidentiality, integrity, and availability of user sessions."}}}}, "created": "2026-03-20T10:36:33.864381+00:00", "updated": "2026-03-20T16:27:39.674774+00:00", "vendors": ["creativemindssolutions", "creativemindssolutions$PRODUCT$cm_custom_reports_\u2013_flexible_reporting_to_track_what_matters_most", "wordpress", "wordpress$PRODUCT$wordpress"]}