QUTTERA-WEB-MALWARE-SCANNER · CVE-2026-115548 · Package
FIX → 4.1.0.49
The Quttera ThreatSign malware scanner plugin for WordPress stores the HTTP User-Agent value without cleaning it, so a visitor can plant script in pages. When an administrator opens an injected page, the script runs in their browser.
first public Nov 7, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Quttera ThreatSign WordPress plugin at version 4.1.0.48 or earlier are exposed. The attack needs no account, and the script runs when an administrator views the injected page, so sites with many admin users or admin pages that show logged requests are most at risk. Sites without this plugin installed can skip it.
Not affected if newer-version, plugin-not-installed
Who cares quttera-threatsign, self-hosted, wordpress
Upgrade to 4.1.0.49
Update Quttera ThreatSign (quttera-web-malware-scanner) to 4.1.0.49 or later; the WordPress.org changelog currently lists 4.1.0.52 with security fixes.
The Quttera ThreatSign – Web Malware Scanner for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_USER_AGENT' parameter in all versions up to, and including, 4.1.0.48 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator accesses an injected page.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.