# Quttera Web Malware Scanner <= 4.1.0.50 - Unauthenticated Stored Cross-Site Scripting via Security Alarm Details

- **ID:** WPSEC-2026-2601
- **Plugin:** Quttera ThreatSign – Web Malware Scanner for WordPress (`quttera-web-malware-scanner`), https://wordpress.org/plugins/quttera-web-malware-scanner/
- **Affected versions:** from 4.0.0.1 before 4.1.0.51
- **Fixed in:** 4.1.0.51 (Update to 4.1.0.51 or later.)
- **Severity:** Medium 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-05)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/quttera-web-malware-scanner
- **Fix released:** 2026-11-04
- **Published:** 2026-11-05
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2601/

## Description

The Quttera Web Malware Scanner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via security alarm details in all versions up to, and including, 4.1.0.50, due to unsafe output handling on the dashboard. When the alarms table is rebuilt in the browser, each alarm object is placed in an inline onclick handler with innerHTML. HTML-encoded quotes in the alarm text, such as a username sent in a failed login attempt, are decoded back into JavaScript there. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that run when an administrator clicks the Details button of the alarm on the plugin's dashboard.

## References

- https://wpsec.com/vuln/WPSEC-2026-2601/
- https://plugins.svn.wordpress.org/quttera-web-malware-scanner/tags/4.1.0.51/
- https://wordpress.org/plugins/quttera-web-malware-scanner/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2601/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.