# Quttera Web Malware Scanner <= 4.1.0.46 - Unauthenticated Stored Cross-Site Scripting via Scan Report

- **ID:** WPSEC-2026-1674
- **Plugin:** Quttera ThreatSign – Web Malware Scanner for WordPress (`quttera-web-malware-scanner`), https://wordpress.org/plugins/quttera-web-malware-scanner/
- **Affected versions:** from 4.1.0.46 before 4.1.0.47
- **Fixed in:** 4.1.0.47 (Update to 4.1.0.47 or later.)
- **Severity:** Medium 4.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-27)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/quttera-web-malware-scanner
- **Fix released:** 2026-10-25
- **Published:** 2026-10-26
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1674/

## Description

The Quttera Web Malware Scanner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the scan report download in all versions up to, and including, 4.1.0.46. This is due to insufficient output escaping in the report viewer: it escapes angle brackets in the report text, URL-decodes the result and then writes it into a new window with document.write(). The report includes up to 60 characters of database content that matched a detection signature. This makes it possible for unauthenticated attackers to store URL-encoded markup in data the database scanner reads and flags, such as rows written by other plugins from visitor input. The markup runs in an administrator's browser, with the site's origin, when the administrator opens the scan report.

## References

- https://wpsec.com/vuln/WPSEC-2026-1674/
- https://plugins.svn.wordpress.org/quttera-web-malware-scanner/tags/4.1.0.47/
- https://wordpress.org/plugins/quttera-web-malware-scanner/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1674/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.