CVE-2026-3551

Περιγραφή

The Custom New User Notification plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin-s admin settings in all versions up to, and including, 1.2.0. This is due to insufficient input sanitization and output escaping on multiple settings fields including -User Mail Subject-, -User From Name-, -User From Email-, -Admin Mail Subject-, -Admin From Name-, and -Admin From Email-. The settings are registered via register_setting() without sanitize callbacks, and the values retrieved via get_option() are echoed directly into HTML input value attributes without esc_attr(). This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in the plugin settings page that will execute whenever a user accesses that page. This could be used in multi-site installations where administrators of subsites could target super administrators.