{
 "id": "WPSEC-2026-1674",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1674/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1674/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1674/index.md",
 "title": "Quttera Web Malware Scanner <= 4.1.0.46 - Unauthenticated Stored Cross-Site Scripting via Scan Report",
 "description": "The Quttera Web Malware Scanner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the scan report download in all versions up to, and including, 4.1.0.46. This is due to insufficient output escaping in the report viewer: it escapes angle brackets in the report text, URL-decodes the result and then writes it into a new window with document.write(). The report includes up to 60 characters of database content that matched a detection signature. This makes it possible for unauthenticated attackers to store URL-encoded markup in data the database scanner reads and flags, such as rows written by other plugins from visitor input. The markup runs in an administrator's browser, with the site's origin, when the administrator opens the scan report.",
 "plugin": {
  "slug": "quttera-web-malware-scanner",
  "name": "Quttera Web Malware Scanner",
  "full_name": "Quttera ThreatSign – Web Malware Scanner for WordPress",
  "wordpress_org": "https://wordpress.org/plugins/quttera-web-malware-scanner/",
  "advisories_url": "https://wpsec.com/vuln/plugin/quttera-web-malware-scanner/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/quttera-web-malware-scanner"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "4.1.0.46",
    "from_inclusive": true,
    "to": "4.1.0.47",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 4.1.0.46 before 4.1.0.47"
  ]
 },
 "introduced_in": "4.1.0.46",
 "fixed_in": "4.1.0.47",
 "remediation": "Update to 4.1.0.47 or later.",
 "fix_released": "2026-10-25T18:51:44+00:00",
 "published": "2026-10-26T19:44:17+00:00",
 "updated": "2026-10-26T09:31:19.782975+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1674/",
  "https://plugins.svn.wordpress.org/quttera-web-malware-scanner/tags/4.1.0.47/",
  "https://wordpress.org/plugins/quttera-web-malware-scanner/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/quttera-web-malware-scanner",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-27"
 }
}