Quttera Web Malware Scanner <= 4.1.0.50 - Unauthenticated Stored Cross-Site Scripting via Security Alarm Details
- ID
- WPSEC-2026-2601
- Plugin
- Quttera ThreatSign – Web Malware Scanner for WordPress (quttera-web-malware-scanner)
- Affected
- from 4.0.0.1 before 4.1.0.51
- Remediation
- Update to 4.1.0.51 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-05
- Attack surface
- Quttera Web Malware Scanner on WPSec AttackSurface
- Fix released
- Published
Description
The Quttera Web Malware Scanner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via security alarm details in all versions up to, and including, 4.1.0.50, due to unsafe output handling on the dashboard. When the alarms table is rebuilt in the browser, each alarm object is placed in an inline onclick handler with innerHTML. HTML-encoded quotes in the alarm text, such as a username sent in a failed login attempt, are decoded back into JavaScript there. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that run when an administrator clicks the Details button of the alarm on the plugin's dashboard.
References
- https://wpsec.com/vuln/WPSEC-2026-2601/
- https://plugins.svn.wordpress.org/quttera-web-malware-scanner/tags/4.1.0.51/
- https://wordpress.org/plugins/quttera-web-malware-scanner/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS