CVE-2026-5293

{"id": "CVE-2026-5293", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5293", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-20T13:02:53.790036Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 3.1}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "olivesystem", "product": "\u8a3a\u65ad\u30b8\u30a7\u30cd\u30ec\u30fc\u30bf\u4f5c\u6210\u30d7\u30e9\u30b0\u30a4\u30f3", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.4.16"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-20T02:16:37.053", "references": [{"url": "https://plugins.trac.wordpress.org/browser/os-diagnosis-generator/tags/1.4.16/class/themeClass.php#L26", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/os-diagnosis-generator/tags/1.4.16/class/themeClass.php#L39", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/os-diagnosis-generator/tags/1.4.16/diagnosisAdminClass.php#L409", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/os-diagnosis-generator/tags/1.4.16/include_files/user-viewFormPage.php#L102", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/os-diagnosis-generator/trunk/class/themeClass.php#L26", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/os-diagnosis-generator/trunk/class/themeClass.php#L39", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/os-diagnosis-generator/trunk/diagnosisAdminClass.php#L409", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/os-diagnosis-generator/trunk/include_files/user-viewFormPage.php#L102", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c5293c0f-90b0-41df-a623-90297d998c41?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "The \u8a3a\u65ad\u30b8\u30a7\u30cd\u30ec\u30fc\u30bf\u4f5c\u6210\u30d7\u30e9\u30b0\u30a4\u30f3 (Diagnosis Generator) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'js' parameter in versions up to and including 1.4.16. This is due to missing authorization checks and insufficient input sanitization in the themeFunc() function. The function is hooked to 'admin_init' and processes theme update requests without verifying user capabilities, allowing any authenticated user (including subscribers) to save malicious JavaScript to theme files. Additionally, the save() function uses stripslashes() which removes WordPress's magic quotes protection. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in theme files that will execute whenever a user accesses a page containing the diagnosis form shortcode."}, {"lang": "es", "value": "El plugin ??????????????? (Diagnosis Generator) para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s del par\u00e1metro 'js' en versiones hasta la 1.4.16 inclusive. Esto se debe a la falta de comprobaciones de autorizaci\u00f3n y a una sanitizaci\u00f3n de entrada insuficiente en la funci\u00f3n themeFunc(). La funci\u00f3n est\u00e1 enganchada a 'admin_init' y procesa solicitudes de actualizaci\u00f3n de temas sin verificar las capacidades del usuario, lo que permite a cualquier usuario autenticado (incluidos los suscriptores) guardar JavaScript malicioso en los archivos del tema. Adem\u00e1s, la funci\u00f3n save() utiliza stripslashes() lo que elimina la protecci\u00f3n de 'magic quotes' de WordPress. Esto hace posible que atacantes autenticados, con acceso de nivel de suscriptor y superior, inyecten scripts web arbitrarios en los archivos del tema que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina que contenga el shortcode del formulario de diagn\u00f3stico."}], "lastModified": "2026-07-24T09:10:00.153", "sourceIdentifier": "security@wordfence.com"}