{
 "id": "WPSEC-2026-2601",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2601/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2601/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2601/index.md",
 "title": "Quttera Web Malware Scanner <= 4.1.0.50 - Unauthenticated Stored Cross-Site Scripting via Security Alarm Details",
 "description": "The Quttera Web Malware Scanner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via security alarm details in all versions up to, and including, 4.1.0.50, due to unsafe output handling on the dashboard. When the alarms table is rebuilt in the browser, each alarm object is placed in an inline onclick handler with innerHTML. HTML-encoded quotes in the alarm text, such as a username sent in a failed login attempt, are decoded back into JavaScript there. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that run when an administrator clicks the Details button of the alarm on the plugin's dashboard.",
 "plugin": {
  "slug": "quttera-web-malware-scanner",
  "name": "Quttera Web Malware Scanner",
  "full_name": "Quttera ThreatSign – Web Malware Scanner for WordPress",
  "wordpress_org": "https://wordpress.org/plugins/quttera-web-malware-scanner/",
  "advisories_url": "https://wpsec.com/vuln/plugin/quttera-web-malware-scanner/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/quttera-web-malware-scanner"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "4.0.0.1",
    "from_inclusive": true,
    "to": "4.1.0.51",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 4.0.0.1 before 4.1.0.51"
  ]
 },
 "introduced_in": "4.0.0.1",
 "fixed_in": "4.1.0.51",
 "remediation": "Update to 4.1.0.51 or later.",
 "fix_released": "2026-11-04T16:38:17+00:00",
 "published": "2026-11-05T16:45:11+00:00",
 "updated": "2026-11-05T09:52:27.570744+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2601/",
  "https://plugins.svn.wordpress.org/quttera-web-malware-scanner/tags/4.1.0.51/",
  "https://wordpress.org/plugins/quttera-web-malware-scanner/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/quttera-web-malware-scanner",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-05"
 }
}