CVE-2026-4336

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4336", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-03-17T14:20:31.307Z", "datePublished": "2026-04-09T03:25:57.761Z", "dateUpdated": "2026-04-09T12:58:47.398Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-09T03:25:57.761Z"}, "affected": [{"vendor": "rustaurius", "product": "Ultimate FAQ Accordion Plugin", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.4.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Ultimate FAQ Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via FAQ content in all versions up to, and including, 2.4.7. This is due to the plugin calling html_entity_decode() on post_content during rendering in the set_display_variables() function (View.FAQ.class.php, line 746), which converts HTML entity-encoded payloads back into executable HTML, combined with insufficient output escaping in the faq-answer.php template where the decoded content is echoed without wp_kses_post() or any other sanitization. The ufaq custom post type is registered with 'show_in_rest' => true and defaults to 'post' capability_type, allowing Author-level users to create and publish FAQs via the REST API. An Author can submit entity-encoded malicious HTML (e.g., &lt;img src=x onerror=alert()&gt;) which bypasses WordPress's kses sanitization at save time (since kses sees entities as plain text, not tags), but is then decoded back into executable HTML by html_entity_decode() at render time. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in FAQ pages that will execute whenever a user accesses an injected FAQ, either directly or via the [ultimate-faqs] shortcode."}], "title": "Ultimate FAQ Accordion Plugin <= 2.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via FAQ Content", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5ac3ac02-d496-46cb-9aff-ffeeb8fd80fa?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-faqs/trunk/ewd-ufaq-templates/faq-answer.php#L2"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-faqs/tags/2.4.7/ewd-ufaq-templates/faq-answer.php#L2"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-faqs/trunk/views/View.FAQ.class.php#L746"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-faqs/tags/2.4.7/views/View.FAQ.class.php#L746"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-faqs/trunk/includes/CustomPostTypes.class.php#L84"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-faqs/tags/2.4.7/includes/CustomPostTypes.class.php#L84"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3492083%40ultimate-faqs&new=3492083%40ultimate-faqs&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}, {"lang": "en", "type": "finder", "value": "Itthidej Aramsri"}], "timeline": [{"time": "2026-03-17T14:35:42.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-04-08T14:25:15.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-09T12:58:39.403559Z", "id": "CVE-2026-4336", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-09T12:58:47.398Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4336", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-09T12:58:39.403559Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-09T12:58:43.557Z"}}], "cna": {"title": "Ultimate FAQ Accordion Plugin <= 2.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via FAQ Content", "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}, {"lang": "en", "type": "finder", "value": "Itthidej Aramsri"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "rustaurius", "product": "Ultimate FAQ Accordion Plugin", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.4.7"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-03-17T14:35:42.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-04-08T14:25:15.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5ac3ac02-d496-46cb-9aff-ffeeb8fd80fa?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-faqs/trunk/ewd-ufaq-templates/faq-answer.php#L2"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-faqs/tags/2.4.7/ewd-ufaq-templates/faq-answer.php#L2"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-faqs/trunk/views/View.FAQ.class.php#L746"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-faqs/tags/2.4.7/views/View.FAQ.class.php#L746"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-faqs/trunk/includes/CustomPostTypes.class.php#L84"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-faqs/tags/2.4.7/includes/CustomPostTypes.class.php#L84"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3492083%40ultimate-faqs&new=3492083%40ultimate-faqs&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Ultimate FAQ Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via FAQ content in all versions up to, and including, 2.4.7. This is due to the plugin calling html_entity_decode() on post_content during rendering in the set_display_variables() function (View.FAQ.class.php, line 746), which converts HTML entity-encoded payloads back into executable HTML, combined with insufficient output escaping in the faq-answer.php template where the decoded content is echoed without wp_kses_post() or any other sanitization. The ufaq custom post type is registered with 'show_in_rest' => true and defaults to 'post' capability_type, allowing Author-level users to create and publish FAQs via the REST API. An Author can submit entity-encoded malicious HTML (e.g., &lt;img src=x onerror=alert()&gt;) which bypasses WordPress's kses sanitization at save time (since kses sees entities as plain text, not tags), but is then decoded back into executable HTML by html_entity_decode() at render time. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in FAQ pages that will execute whenever a user accesses an injected FAQ, either directly or via the [ultimate-faqs] shortcode."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-09T03:25:57.761Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4336", "state": "PUBLISHED", "dateUpdated": "2026-04-09T12:58:47.398Z", "dateReserved": "2026-03-17T14:20:31.307Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-04-09T03:25:57.761Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Ultimate FAQ Accordion Plugin", "vendor": "rustaurius", "versions": [{"lessThanOrEqual": "2.4.7", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Ultimate FAQ Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via FAQ content in all versions up to, and including, 2.4.7. This is due to the plugin calling html_entity_decode() on post_content during rendering in the set_display_variables() function (View.FAQ.class.php, line 746), which converts HTML entity-encoded payloads back into executable HTML, combined with insufficient output escaping in the faq-answer.php template where the decoded content is echoed without wp_kses_post() or any other sanitization. The ufaq custom post type is registered with 'show_in_rest' => true and defaults to 'post' capability_type, allowing Author-level users to create and publish FAQs via the REST API. An Author can submit entity-encoded malicious HTML (e.g., &lt;img src=x onerror=alert()&gt;) which bypasses WordPress's kses sanitization at save time (since kses sees entities as plain text, not tags), but is then decoded back into executable HTML by html_entity_decode() at render time. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in FAQ pages that will execute whenever a user accesses an injected FAQ, either directly or via the [ultimate-faqs] shortcode."}], "id": "CVE-2026-4336", "lastModified": "2026-06-17T10:56:26.447", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4336", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-09T12:58:39.403559Z", "version": "2.0.3"}}]}, "published": "2026-04-09T05:16:04.910", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ultimate-faqs/tags/2.4.7/ewd-ufaq-templates/faq-answer.php#L2"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ultimate-faqs/tags/2.4.7/includes/CustomPostTypes.class.php#L84"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ultimate-faqs/tags/2.4.7/views/View.FAQ.class.php#L746"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ultimate-faqs/trunk/ewd-ufaq-templates/faq-answer.php#L2"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ultimate-faqs/trunk/includes/CustomPostTypes.class.php#L84"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ultimate-faqs/trunk/views/View.FAQ.class.php#L746"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3492083%40ultimate-faqs&new=3492083%40ultimate-faqs&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5ac3ac02-d496-46cb-9aff-ffeeb8fd80fa?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.4.7]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Ultimate FAQ Accordion Plugin", "source": "cna", "vendor": "rustaurius"}, "product": "ultimate_faq_accordion_plugin", "vendor": "rustaurius"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-09T05:50:21.871631+00:00", "value": {"mitigation_remediation": ["Update to a version newer than 2.4.7.", "If no update is available, disable or restrict the REST API endpoints for the FAQ custom post type or remove edit permissions from Author users.", "Audit existing FAQ posts and remove any that contain malicious or suspicious HTML.", "Deploy a web application firewall or security plugin that blocks inline script execution on FAQ pages.", "Monitor site activity for unexpected script execution and review user permissions regularly."], "summary": {"action": "Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The vulnerability affects installations of the Ultimate FAQ Accordion Plugin from versions 2.4.7 and earlier, deployed on WordPress sites. The plugin registers a custom post type with REST API support and uses the default \u2018post\u2019 capability type, enabling Author users to create and publish FAQ posts.", "description_and_impact": "An authenticated attacker with Author or higher role can embed arbitrary JavaScript into FAQ content by submitting entity\u2011encoded payloads such as &lt;img src=x onerror=alert()&gt; . When the content is displayed, the plugin decodes the entities back into executable HTML while failing to apply proper output escaping, allowing the script to run in every visitor\u2019s browser. This can lead to defacement, credential theft, session hijacking, or other malicious actions.", "risk_and_exploitability": "The CVSS score of 6.4 indicates a moderate severity; the EPSS score is not available and the issue is not listed in the CISA KEV catalog. Exploitation requires only author\u2011level credentials, a common level of access in content\u2011management workflows, suggesting that once an author account is compromised or misused, the attack can be carried out during normal FAQ creation. The attack vector is likely via the REST API or the post\u2011editing interface, exploiting the lack of proper sanitization at display time."}}}}, "created": "2026-04-09T08:15:38.093711+00:00", "updated": "2026-04-09T08:25:04.568582+00:00", "vendors": ["rustaurius", "rustaurius$PRODUCT$ultimate_faq_accordion_plugin", "wordpress", "wordpress$PRODUCT$wordpress"]}