CVE-2026-2489

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2489", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-13T21:05:22.465Z", "datePublished": "2026-02-26T01:24:14.916Z", "dateUpdated": "2026-04-08T16:51:49.148Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:51:49.148Z"}, "affected": [{"vendor": "readymadeweb", "product": "TP2WP Importer", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The TP2WP Importer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Watched domains' textarea on the attachment importer settings page in all versions up to, and including, 1.1. This is due to insufficient input sanitization and output escaping when domains are saved via AJAX and rendered with echo implode() without esc_textarea(). This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the attachment importer settings page."}], "title": "TP2WP Importer <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Watched domains' Textarea", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4eacf7b7-100b-423d-920f-14f3e33f5f60?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/tp2wp-importer/trunk/attachments/templates/page.php#L28"}, {"url": "https://plugins.trac.wordpress.org/browser/tp2wp-importer/tags/1.1/attachments/templates/page.php#L28"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Nur Ibnu Hubab"}], "timeline": [{"time": "2026-02-25T12:51:03.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-26T15:29:03.307705Z", "id": "CVE-2026-2489", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T15:29:15.546Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2489", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-26T15:29:03.307705Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T15:29:09.884Z"}}], "cna": {"title": "TP2WP Importer <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Watched domains' Textarea", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Nur Ibnu Hubab"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "readymadeweb", "product": "TP2WP Importer", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-25T12:51:03.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4eacf7b7-100b-423d-920f-14f3e33f5f60?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/tp2wp-importer/trunk/attachments/templates/page.php#L28"}, {"url": "https://plugins.trac.wordpress.org/browser/tp2wp-importer/tags/1.1/attachments/templates/page.php#L28"}], "descriptions": [{"lang": "en", "value": "The TP2WP Importer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Watched domains' textarea on the attachment importer settings page in all versions up to, and including, 1.1. This is due to insufficient input sanitization and output escaping when domains are saved via AJAX and rendered with echo implode() without esc_textarea(). This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the attachment importer settings page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-02-26T01:24:14.916Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2489", "state": "PUBLISHED", "dateUpdated": "2026-02-26T15:29:15.546Z", "dateReserved": "2026-02-13T21:05:22.465Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-26T01:24:14.916Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "TP2WP Importer", "vendor": "readymadeweb", "versions": [{"lessThanOrEqual": "1.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The TP2WP Importer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Watched domains' textarea on the attachment importer settings page in all versions up to, and including, 1.1. This is due to insufficient input sanitization and output escaping when domains are saved via AJAX and rendered with echo implode() without esc_textarea(). This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the attachment importer settings page."}, {"lang": "es", "value": "El plugin TP2WP Importer para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del \u00e1rea de texto 'Watched domains' en la p\u00e1gina de configuraci\u00f3n del importador de adjuntos en todas las versiones hasta la 1.1, inclusive. Esto se debe a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes cuando los dominios se guardan a trav\u00e9s de AJAX y se renderizan con echo implode() sin esc_textarea(). Esto hace posible que atacantes autenticados, con acceso de nivel de Administrador y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a la p\u00e1gina de configuraci\u00f3n del importador de adjuntos."}], "id": "CVE-2026-2489", "lastModified": "2026-06-17T10:31:09.423", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2489", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T15:29:03.307705Z", "version": "2.0.3"}}]}, "published": "2026-02-26T02:16:24.890", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/tp2wp-importer/tags/1.1/attachments/templates/page.php#L28"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/tp2wp-importer/trunk/attachments/templates/page.php#L28"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4eacf7b7-100b-423d-920f-14f3e33f5f60?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "TP2WP Importer", "source": "cna", "vendor": "readymadeweb"}, "product": "tp2wp_importer", "vendor": "readymadeweb"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T20:12:43.336447+00:00", "value": {"mitigation_remediation": ["Upgrade TP2WP Importer to the latest released version that includes the input sanitization fix (versions greater than 1.1).", "If an upgrade is not yet available, restrict Administrator access to trusted users only and review active roles to prevent unauthorized modifications of plugin settings.", "Implement a strict Content Security Policy (CSP) that blocks inline scripts and restricts script sources to whitelisted domains, mitigating the effect of any stored XSS payload."], "summary": {"action": "Patch", "impact": "Stored Cross\u2011Site Scripting (XSS) affecting administrator users"}, "threat_synthesis": {"affected_systems": "The affected product is the TP2WP Importer plugin from readymadeweb. All released versions up to and including 1.1 are vulnerable; any site running the plugin on those versions is at risk.", "description_and_impact": "The TP2WP Importer plugin for WordPress is vulnerable to stored cross\u2011site scripting via the \u2018Watched domains\u2019 textarea on the attachment importer settings page. The flaw originates from missing input sanitization and output escaping when user\u2011supplied domains are saved via AJAX and later rendered with echo implode() without the appropriate esc_textarea() call. This allows an attacker with Administrator\u2011level privileges to inject arbitrary JavaScript, which will execute for anyone who navigates to the settings page. The impact is that compromised administrators can alter page content, steal credentials or redirect users, enabling further exploitation. The weakness corresponds to CWE\u201179.", "risk_and_exploitability": "The CVSS score of 4.4 indicates a moderate severity. The EPSS score of less than 1% reflects a very low probability of exploitation at the time of analysis, and the vulnerability is not listed in CISA\u2019s KEV catalog. The attack vector requires the attacker to have authenticated access with Administrator\u2011level or higher privileges. Once authenticated, the attacker can persist malicious script in a textarea that will run in the browser of any user who views the settings page, potentially leading to credential compromise or defacement."}}}}, "created": "2026-02-26T13:10:02.538861+00:00", "updated": "2026-04-15T20:15:13.724143+00:00", "vendors": ["readymadeweb", "readymadeweb$PRODUCT$tp2wp_importer", "wordpress", "wordpress$PRODUCT$wordpress"]}