CVE-2026-4069

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4069", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-03-12T19:41:42.490Z", "datePublished": "2026-03-21T03:26:43.400Z", "dateUpdated": "2026-04-08T16:49:16.544Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:49:16.544Z"}, "affected": [{"vendor": "pftool", "product": "Alfie \u2013 Feed Plugin", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.2.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Alfie \u2013 Feed Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'naam' parameter in all versions up to, and including, 1.2.1. This is due to missing nonce validation on the alfie_option_page() function combined with insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject malicious web scripts that will be stored in the plugin's database and execute whenever a user accesses the page displaying the injected data, granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Alfie \u2013 Feed Plugin <= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'naam' Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/440ff558-d304-4c2e-b9e2-988b31dcbcb6?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/trunk/include/alfie-option.php#L59-L59"}, {"url": "https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/tags/1.2.1/include/alfie-option.php#L59-L59"}, {"url": "https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/trunk/include/alfie-option.php#L60-L60"}, {"url": "https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/tags/1.2.1/include/alfie-option.php#L60-L60"}, {"url": "https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/trunk/include/alfie-option.php#L75-L75"}, {"url": "https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/tags/1.2.1/include/alfie-option.php#L75-L75"}, {"url": "https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/trunk/include/alfie-manage.php#L104-L104"}, {"url": "https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/tags/1.2.1/include/alfie-manage.php#L104-L104"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Nur Ibnu Hubab"}], "timeline": [{"time": "2026-03-20T15:07:56.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-23T15:07:43.278255Z", "id": "CVE-2026-4069", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T15:54:57.554Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4069", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-23T15:07:43.278255Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T15:07:44.277Z"}}], "cna": {"title": "Alfie \u2013 Feed Plugin <= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'naam' Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Nur Ibnu Hubab"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "pftool", "product": "Alfie \u2013 Feed Plugin", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.2.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-03-20T15:07:56.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/440ff558-d304-4c2e-b9e2-988b31dcbcb6?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/trunk/include/alfie-option.php#L59-L59"}, {"url": "https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/tags/1.2.1/include/alfie-option.php#L59-L59"}, {"url": "https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/trunk/include/alfie-option.php#L60-L60"}, {"url": "https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/tags/1.2.1/include/alfie-option.php#L60-L60"}, {"url": "https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/trunk/include/alfie-option.php#L75-L75"}, {"url": "https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/tags/1.2.1/include/alfie-option.php#L75-L75"}, {"url": "https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/trunk/include/alfie-manage.php#L104-L104"}, {"url": "https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/tags/1.2.1/include/alfie-manage.php#L104-L104"}], "descriptions": [{"lang": "en", "value": "The Alfie \u2013 Feed Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'naam' parameter in all versions up to, and including, 1.2.1. This is due to missing nonce validation on the alfie_option_page() function combined with insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject malicious web scripts that will be stored in the plugin's database and execute whenever a user accesses the page displaying the injected data, granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:49:16.544Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4069", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:49:16.544Z", "dateReserved": "2026-03-12T19:41:42.490Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-21T03:26:43.400Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Alfie \u2013 Feed Plugin", "vendor": "pftool", "versions": [{"lessThanOrEqual": "1.2.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Alfie \u2013 Feed Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'naam' parameter in all versions up to, and including, 1.2.1. This is due to missing nonce validation on the alfie_option_page() function combined with insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject malicious web scripts that will be stored in the plugin's database and execute whenever a user accesses the page displaying the injected data, granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin Alfie \u2013 Feed Plugin para WordPress es vulnerable a Stored Cross-Site Scripting a trav\u00e9s del par\u00e1metro 'naam' en todas las versiones hasta la 1.2.1, inclusive. Esto se debe a la falta de validaci\u00f3n de nonce en la funci\u00f3n alfie_option_page() combinada con una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto hace posible que atacantes no autenticados inyecten scripts web maliciosos que se almacenar\u00e1n en la base de datos del plugin y se ejecutar\u00e1n cada vez que un usuario acceda a la p\u00e1gina que muestra los datos inyectados, siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2026-4069", "lastModified": "2026-06-17T10:55:56.317", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4069", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-23T15:07:43.278255Z", "version": "2.0.3"}}]}, "published": "2026-03-21T04:17:40.220", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/tags/1.2.1/include/alfie-manage.php#L104-L104"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/tags/1.2.1/include/alfie-option.php#L59-L59"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/tags/1.2.1/include/alfie-option.php#L60-L60"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/tags/1.2.1/include/alfie-option.php#L75-L75"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/trunk/include/alfie-manage.php#L104-L104"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/trunk/include/alfie-option.php#L59-L59"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/trunk/include/alfie-option.php#L60-L60"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/trunk/include/alfie-option.php#L75-L75"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/440ff558-d304-4c2e-b9e2-988b31dcbcb6?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.2.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Alfie \u2013 Feed Plugin", "source": "cna", "vendor": "pftool"}, "product": "alfie_\u2013_feed_plugin", "vendor": "pftool"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-21T07:19:28.666128+00:00", "value": {"mitigation_remediation": ["Upgrade the Alfie \u2013 Feed Plugin to the latest version that removes the unsanitized 'naam' handling.", "If an immediate upgrade is not possible, temporarily disable or uninstall the Alfie \u2013 Feed Plugin until a patched version is released.", "Review the plugin\u2019s database entries for any injected scripts and clear them manually.", "Ensure administrators are aware of the risk of clicking on unfamiliar links that might trigger the vulnerable action.", "Consider implementing a site\u2011wide security audit or firewall rule to block suspicious parameters to the plugin\u2019s processing endpoints."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "WordPress sites that have the Alfie \u2013 Feed Plugin (developer: pftool) installed with version 1.2.1 or any earlier release are vulnerable. The issue exists in all releases up to and including 1.2.1; newer releases or the trunk code base do not contain the flaw.", "description_and_impact": "The Alfie \u2013 Feed Plugin for WordPress embeds user\u2011supplied data from the 'naam' parameter directly into the database without validating a nonce or escaping the input. This flaw enables an unauthenticated attacker to inject JavaScript that is permanently stored and executed whenever the affected page is loaded. As a result, visitors or administrators who load the page can have their session data stolen, be redirected to malicious sites, or have the site defaced.", "risk_and_exploitability": "The CVSS score of 6.1 indicates a moderate severity. The attack requires no authentication but relies on convincing an administrator to trigger the payload, typically by clicking on a crafted link or form. Because the malicious code is stored in the database, it persists across users and sessions, amplifying the impact. No EPSS score is currently available, and the vulnerability is not listed in CISA\u2019s KEV catalog."}}}}, "created": "2026-03-23T09:50:44.976486+00:00", "updated": "2026-03-25T14:42:18.357794+00:00", "vendors": ["pftool", "pftool$PRODUCT$alfie_\u2013_feed_plugin", "wordpress", "wordpress$PRODUCT$wordpress"]}