https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 13:44:15 +0000 https://cve.radiocsirt.org/vuln/cve-2026-3551 <p><strong>Affected:</strong> rafasashi Custom New User Notification</p> <p>The Custom New User Notification plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin&#39;s admin settings in all versions up to, and including, 1.2.0. This is due to insufficient input sanitization and output escaping on multiple settings fields including &#39;User Mail Subject&#39;, &#39;User From Name&#39;, &#39;User From Email&#39;, &#39;Admin Mail Subject&#39;, &#39;Admin From Name&#39;, and &#39;Admin From Email&#39;. The settings are registered via register_setting() without sanitize callbacks, and the values retrieved via get_option() are echoed directly into HTML input value attributes without esc_attr(). This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in the plugin settings page that will execute whenever a user accesses that page. This could be used in multi-site installations where administrators of subsites could target super administrators.</p> <p><strong>Affected:</strong> rafasashi Custom New User Notification</p> <p>The Custom New User Notification plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin&#39;s admin settings in all versions up to, and including, 1.2.0. This is due to insufficient input sanitization and output escaping on multiple settings fields including &#39;User Mail Subject&#39;, &#39;User From Name&#39;, &#39;User From Email&#39;, &#39;Admin Mail Subject&#39;, &#39;Admin From Name&#39;, and &#39;Admin From Email&#39;. The settings are registered via register_setting() without sanitize callbacks, and the values retrieved via get_option() are echoed directly into HTML input value attributes without esc_attr(). This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in the plugin settings page that will execute whenever a user accesses that page. This could be used in multi-site installations where administrators of subsites could target super administrators.</p> https://cve.radiocsirt.org/vuln/cve-2026-3551