Quttera Web Malware Scanner <= 4.1.0.46 - Unauthenticated Stored Cross-Site Scripting via Scan Report
- ID
- WPSEC-2026-1674
- Plugin
- Quttera ThreatSign – Web Malware Scanner for WordPress (quttera-web-malware-scanner)
- Affected
- from 4.1.0.46 before 4.1.0.47
- Remediation
- Update to 4.1.0.47 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-27
- Attack surface
- Quttera Web Malware Scanner on WPSec AttackSurface
- Fix released
- Published
Description
The Quttera Web Malware Scanner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the scan report download in all versions up to, and including, 4.1.0.46. This is due to insufficient output escaping in the report viewer: it escapes angle brackets in the report text, URL-decodes the result and then writes it into a new window with document.write(). The report includes up to 60 characters of database content that matched a detection signature. This makes it possible for unauthenticated attackers to store URL-encoded markup in data the database scanner reads and flags, such as rows written by other plugins from visitor input. The markup runs in an administrator's browser, with the site's origin, when the administrator opens the scan report.
References
- https://wpsec.com/vuln/WPSEC-2026-1674/
- https://plugins.svn.wordpress.org/quttera-web-malware-scanner/tags/4.1.0.47/
- https://wordpress.org/plugins/quttera-web-malware-scanner/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS