{"id":"CVE-2026-113409","kind":"vulnerability","aliases":["CVE-2026-113409"],"related":[],"title":"Ortto WordPress plugin: stored settings enable admin-session script injection","description":"The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting. A threat actor able to modify the plugin's configuration could execute arbitrary JavaScript in an administrator's session when they visited the impacted page.","summary":"The Ortto plugin for WordPress before 1.0.25 does not escape stored settings on its admin page, which allows stored cross-site scripting. An attacker who can change the plugin's configuration can run JavaScript in an administrator's browser session when that admin opens the settings page.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ortto","package","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed","plugin-version-1.0.25-or-later","settings-restricted-to-trusted-admins"],"how_to_check":"- Check the installed Ortto plugin version in the WordPress admin under Plugins, or with `wp plugin get ortto --field=version` if WP-CLI is available.\n- Confirm whether any users other than trusted administrators can change the plugin's settings.","fix":"- Update the Ortto plugin to `1.0.25` or later.\n- Until updated, restrict who can change plugin settings and review stored settings for unexpected script content.","status":"open","published_at":"2026-10-29T02:16:50+00:00","first_seen_at":"2026-10-29T02:36:47+00:00","triaged_at":"2026-10-29T02:38:08+00:00","updated_at":"2026-10-29T02:38:08+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T02:38:08Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Ortto plugin to `1.0.25` or later.\n- Until updated, restrict who can change plugin settings and review stored settings for unexpected script content.","reach":"network","title":"Ortto WordPress plugin: stored settings enable admin-session script injection","impact":"medium","summary":"The Ortto plugin for WordPress before 1.0.25 does not escape stored settings on its admin page, which allows stored cross-site scripting. An attacker who can change the plugin's configuration can run JavaScript in an administrator's browser session when that admin opens the settings page.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","ortto"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker runs JavaScript in an administrator's WordPress session","analyst_note":"Confirm the exact minimum role needed to change the settings and whether the vendor or NVD lists a patched release note beyond 1.0.25.","how_to_check":"- Check the installed Ortto plugin version in the WordPress admin under Plugins, or with `wp plugin get ortto --field=version` if WP-CLI is available.\n- Confirm whether any users other than trusted administrators can change the plugin's settings.","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-version-1.0.25-or-later","settings-restricted-to-trusted-admins"],"who_is_affected":"Sites running the Ortto plugin for WordPress at a version before 1.0.25. The risk needs someone able to modify the plugin configuration, so sites where only trusted administrators manage settings face lower exposure. Sites that do not use the Ortto plugin can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000646,"input_tokens":3318,"output_tokens":629,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113409':14A,17A '-2026':13A,16A '1.0.25':30B,78C 'abl':99C 'actor':98C 'admin':8A,38B,67B,86C 'admin-sess':7A 'administr':61B,112C 'allow':41B 'arbitrari':108C 'attack':48B 'browser':63B 'chang':51B 'configur':55B,105C 'could':106C 'cross':44B,93C 'cross-sit':43B,92C 'cve':12A,15A 'enabl':6A 'escap':33B,81C 'execut':107C 'impact':119C 'inject':11A 'javascript':58B,109C 'lead':89C 'modifi':101C 'open':68B 'ortto':1A,18B,25B,73C 'packag':19B 'page':39B,71B,88C,120C 'plugin':3A,23B,26B,53B,74C,103C 'run':57B 'script':10A,46B,95C 'session':9A,64B,114C 'set':5A,35B,70B,83C,87C 'site':45B,94C 'store':4A,34B,42B,82C,91C 'threat':97C 'visit':117C 'wordpress':2A,20B,22B,28B,76C 'wordpress-plugin':21B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Ortto plugin for WordPress at a version before 1.0.25. The risk needs someone able to modify the plugin configuration, so sites where only trusted administrators manage settings face lower exposure. Sites that do not use the Ortto plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2026-10-29T02:16:50+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","cvss_by":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113409","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113409","severity":null,"published_at":"2026-10-29T02:16:50+00:00","modified_at":"2026-10-29T02:16:50+00:00","first_seen_at":"2026-10-29T02:36:47+00:00","fetched_at":"2026-10-29T02:36:47+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}