CVE-2026-3551

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3551", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-03-04T18:49:36.648Z", "datePublished": "2026-04-16T05:29:53.185Z", "dateUpdated": "2026-04-16T13:42:26.444Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-16T05:29:53.185Z"}, "affected": [{"vendor": "rafasashi", "product": "Custom New User Notification", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.2.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Custom New User Notification plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's admin settings in all versions up to, and including, 1.2.0. This is due to insufficient input sanitization and output escaping on multiple settings fields including 'User Mail Subject', 'User From Name', 'User From Email', 'Admin Mail Subject', 'Admin From Name', and 'Admin From Email'. The settings are registered via register_setting() without sanitize callbacks, and the values retrieved via get_option() are echoed directly into HTML input value attributes without esc_attr(). This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in the plugin settings page that will execute whenever a user accesses that page. This could be used in multi-site installations where administrators of subsites could target super administrators."}], "title": "Custom New User Notification <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'User Mail Subject' Setting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7a14d35d-144c-4ddd-b288-5e0e006fb165?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/trunk/admin/includes.php#L46"}, {"url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/tags/1.2.0/admin/includes.php#L46"}, {"url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/trunk/admin/includes.php#L52"}, {"url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/tags/1.2.0/admin/includes.php#L52"}, {"url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/trunk/admin/includes.php#L59"}, {"url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/tags/1.2.0/admin/includes.php#L59"}, {"url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/trunk/admin/includes.php#L84"}, {"url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/tags/1.2.0/admin/includes.php#L84"}, {"url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/trunk/admin/includes.php#L90"}, {"url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/tags/1.2.0/admin/includes.php#L90"}, {"url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/trunk/admin/includes.php#L97"}, {"url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/tags/1.2.0/admin/includes.php#L97"}, {"url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/trunk/admin/includes.php#L132"}, {"url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/tags/1.2.0/admin/includes.php#L132"}, {"url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/trunk/custom-new-user-notification.php#L63"}, {"url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/tags/1.2.0/custom-new-user-notification.php#L63"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Nur Ibnu Hubab"}], "timeline": [{"time": "2026-04-15T16:46:28.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-16T13:29:37.796953Z", "id": "CVE-2026-3551", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T13:42:26.444Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3551", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-16T13:29:37.796953Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T13:29:45.270Z"}}], "cna": {"title": "Custom New User Notification <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'User Mail Subject' Setting", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Nur Ibnu Hubab"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "rafasashi", "product": "Custom New User Notification", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.2.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-04-15T16:46:28.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7a14d35d-144c-4ddd-b288-5e0e006fb165?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/trunk/admin/includes.php#L46"}, {"url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/tags/1.2.0/admin/includes.php#L46"}, {"url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/trunk/admin/includes.php#L52"}, {"url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/tags/1.2.0/admin/includes.php#L52"}, {"url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/trunk/admin/includes.php#L59"}, {"url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/tags/1.2.0/admin/includes.php#L59"}, {"url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/trunk/admin/includes.php#L84"}, {"url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/tags/1.2.0/admin/includes.php#L84"}, {"url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/trunk/admin/includes.php#L90"}, {"url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/tags/1.2.0/admin/includes.php#L90"}, {"url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/trunk/admin/includes.php#L97"}, {"url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/tags/1.2.0/admin/includes.php#L97"}, {"url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/trunk/admin/includes.php#L132"}, {"url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/tags/1.2.0/admin/includes.php#L132"}, {"url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/trunk/custom-new-user-notification.php#L63"}, {"url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/tags/1.2.0/custom-new-user-notification.php#L63"}], "descriptions": [{"lang": "en", "value": "The Custom New User Notification plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's admin settings in all versions up to, and including, 1.2.0. This is due to insufficient input sanitization and output escaping on multiple settings fields including 'User Mail Subject', 'User From Name', 'User From Email', 'Admin Mail Subject', 'Admin From Name', and 'Admin From Email'. The settings are registered via register_setting() without sanitize callbacks, and the values retrieved via get_option() are echoed directly into HTML input value attributes without esc_attr(). This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in the plugin settings page that will execute whenever a user accesses that page. This could be used in multi-site installations where administrators of subsites could target super administrators."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-16T05:29:53.185Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3551", "state": "PUBLISHED", "dateUpdated": "2026-04-16T13:42:26.444Z", "dateReserved": "2026-03-04T18:49:36.648Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-04-16T05:29:53.185Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Custom New User Notification", "vendor": "rafasashi", "versions": [{"lessThanOrEqual": "1.2.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Custom New User Notification plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's admin settings in all versions up to, and including, 1.2.0. This is due to insufficient input sanitization and output escaping on multiple settings fields including 'User Mail Subject', 'User From Name', 'User From Email', 'Admin Mail Subject', 'Admin From Name', and 'Admin From Email'. The settings are registered via register_setting() without sanitize callbacks, and the values retrieved via get_option() are echoed directly into HTML input value attributes without esc_attr(). This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in the plugin settings page that will execute whenever a user accesses that page. This could be used in multi-site installations where administrators of subsites could target super administrators."}], "id": "CVE-2026-3551", "lastModified": "2026-06-17T10:43:46.430", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3551", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-16T13:29:37.796953Z", "version": "2.0.3"}}]}, "published": "2026-04-16T06:16:10.530", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/tags/1.2.0/admin/includes.php#L132"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/tags/1.2.0/admin/includes.php#L46"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/tags/1.2.0/admin/includes.php#L52"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/tags/1.2.0/admin/includes.php#L59"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/tags/1.2.0/admin/includes.php#L84"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/tags/1.2.0/admin/includes.php#L90"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/tags/1.2.0/admin/includes.php#L97"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/tags/1.2.0/custom-new-user-notification.php#L63"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/trunk/admin/includes.php#L132"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/trunk/admin/includes.php#L46"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/trunk/admin/includes.php#L52"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/trunk/admin/includes.php#L59"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/trunk/admin/includes.php#L84"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/trunk/admin/includes.php#L90"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/trunk/admin/includes.php#L97"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/custom-new-user-notification/trunk/custom-new-user-notification.php#L63"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7a14d35d-144c-4ddd-b288-5e0e006fb165?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.2.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Custom New User Notification", "source": "cna", "vendor": "rafasashi"}, "product": "custom_new_user_notification", "vendor": "rafasashi"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-16T08:55:45.986684+00:00", "value": {"mitigation_remediation": ["Upgrade the Custom New User Notification plugin to the latest release that addresses the XSS issue, or remove the plugin entirely if no update is available. ", "Limit Administrator privileges by ensuring only trusted accounts have full admin rights, thereby reducing the number of accounts that could exploit the vulnerability. ", "Apply a site\u2011wide JavaScript filter or use a reputable security plugin that blocks XSS in admin areas to mitigate the risk if an update is not immediately feasible. ", "Audit other plugin and theme settings for missing sanitization and escaping practices to prevent similar stored XSS vulnerabilities elsewhere on the site."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting via the Custom New User Notification plugin settings page leading to arbitrary script execution for site administrators"}, "threat_synthesis": {"affected_systems": "The affected product is the WordPress plugin \"Custom New User Notification\" developed by rafasashi. All releases up to, and including, version 1.2.0 are vulnerable. Site administrators using these versions should treat the plugin as compromised until upgraded or removed.", "description_and_impact": "The vulnerability arises because the Custom New User Notification plugin registers multiple email\u2011related settings without applying sanitization or escaping when storing and rendering them. An attacker who can authenticate as an administrator can inject malicious JavaScript into fields such as \"User Mail Subject\" or \"Admin From Email\". When any administrator later visits the plugin\u2019s settings page, the stored script will execute in that staff member\u2019s browser, enabling the attacker to perform actions such as phishing, cookie theft, or form manipulation on behalf of the victim. This is a classic stored XSS flaw that is not mitigated by WordPress core but entirely depends on the plugin\u2019s implementation.", "risk_and_exploitability": "The CVSS v3 score for this weakness is 4.4, indicating moderate severity. No EPSS data is available, and the flaw is not currently listed in the CISA KEV catalog, implying limited public exploitation yet. The attack vector requires authenticated access with Administrator privileges; therefore, the likelihood of exploitation is tied to the attacker\u2019s ability to gain such credentials. Once authenticated, the flaw can be triggered simply by an administrator re\u2011visiting the settings page, allowing widespread impact on the site\u2019s admin interface."}}}}, "created": "2026-04-16T09:00:05.292020+00:00", "updated": "2026-04-16T09:11:49.180402+00:00", "vendors": ["rafasashi", "rafasashi$PRODUCT$custom_new_user_notification", "wordpress", "wordpress$PRODUCT$wordpress"]}