{"id":"CVE-2026-115548","kind":"vulnerability","aliases":["CVE-2026-115548"],"related":[],"title":"Quttera ThreatSign WordPress plugin: stored script injection via User-Agent header","description":"The Quttera ThreatSign – Web Malware Scanner for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_USER_AGENT' parameter in all versions up to, and including, 4.1.0.48 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator accesses an injected page.","summary":"The Quttera ThreatSign malware scanner plugin for WordPress stores the HTTP User-Agent value without cleaning it, so a visitor can plant script in pages. When an administrator opens an injected page, the script runs in their browser.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"quttera-web-malware-scanner","fixed":["4.1.0.49"],"affected":"<= 4.1.0.48","ecosystem":"wordpress"}],"ecosystems":[],"tags":["package","quttera-threatsign","self-hosted","wordpress"],"not_affected_if":["newer-version","plugin-not-installed"],"how_to_check":"- In WordPress admin > Plugins, find Quttera ThreatSign – Web Malware Scanner for WordPress and read its version\n- Versions 4.1.0.48 and earlier are affected; 4.1.0.49 or later is patched (per Wordfence)\n- Or with WP-CLI: wp plugin get quttera-web-malware-scanner --field=version","fix":"Update Quttera ThreatSign (quttera-web-malware-scanner) to 4.1.0.49 or later; the WordPress.org changelog currently lists 4.1.0.52 with security fixes.","status":"open","published_at":"2026-11-07T12:17:42+00:00","first_seen_at":"2026-11-07T12:47:08+00:00","triaged_at":"2026-11-07T12:48:53+00:00","updated_at":"2026-11-07T12:52:34+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-07T12:48:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Quttera ThreatSign WordPress plugin: stored script injection via User-Agent header","impact":"high","summary":"The Quttera ThreatSign malware scanner plugin for WordPress stores the HTTP User-Agent value without cleaning it, so a visitor can plant script in pages. When an administrator opens an injected page, the script runs in their browser.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","quttera-threatsign","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"script runs in administrator browser, enabling admin session takeover","analyst_note":"Confirm the fixed version and vendor advisory at the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-115548); the sources give no fixed version.","how_to_check":"- Check whether the Quttera ThreatSign plugin is installed and its version in the WordPress admin Plugins screen\n- Compare the installed version with `4.1.0.48`; versions up to and including it are listed as affected","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","newer-version"],"who_is_affected":"Sites running the Quttera ThreatSign WordPress plugin at version 4.1.0.48 or earlier are exposed. The attack needs no account, and the script runs when an administrator views the injected page, so sites with many admin users or admin pages that show logged requests are most at risk. Sites without this plugin installed can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000723,"input_tokens":4298,"output_tokens":586,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and vendor advisory at the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-115548); the sources give no fixed version.","search":"'-115548':15A,18A '-2026':14A,17A '4.1.0.48':103C 'access':132C 'administr':60B,131C 'agent':11A,45B,94C 'arbitrari':121C 'attack':118C 'browser':70B 'clean':48B 'cross':87C 'cross-sit':86C 'cve':13A,16A 'due':104C 'escap':111C 'execut':128C 'header':12A 'host':30B 'http':42B,92C 'includ':102C 'inject':7A,63B,120C,134C 'input':107C 'insuffici':106C 'make':113C 'malwar':35B,75C 'malware':22A 'open':61B 'output':110C 'packag':24B 'page':57B,64B,125C,135C 'paramet':95C 'plant':54B 'plugin':4A,37B,79C 'possibl':115C 'quttera':1A,20A,26B,33B,72C 'quttera-threatsign':25B 'quttera-web-malware-scanner':19A 'run':67B 'sanit':108C 'scanner':23A,36B,76C 'script':6A,55B,66B,89C,123C 'self':29B 'self-host':28B 'site':88C 'store':5A,40B,85C 'threatsign':2A,27B,34B,73C 'unauthent':117C 'user':10A,44B,93C 'user-ag':9A,43B 'valu':46B 'version':98C 'via':8A,90C 'visitor':52B 'vulner':83C 'web':21A,74C,122C 'whenev':129C 'without':47B 'wordpress':3A,31B,39B,78C,81C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Quttera ThreatSign WordPress plugin at version 4.1.0.48 or earlier are exposed. The attack needs no account, and the script runs when an administrator views the injected page, so sites with many admin users or admin pages that show logged requests are most at risk. Sites without this plugin installed can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["qutterawebmalwarescanner"],"ptokens":["malware","quttera","scanner","web"],"labels":["high","package","qutterathreatsign","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-115548':15A,18A '-2026':14A,17A 'agent':11A 'cve':13A,16A 'header':12A 'inject':7A 'malware':22A 'plugin':4A 'quttera':1A,20A 'quttera-web-malware-scanner':19A 'scanner':23A 'script':6A 'store':5A 'threatsign':2A 'user':10A 'user-ag':9A 'via':8A 'web':21A 'wordpress':3A","search_b":"'administr':60B 'agent':45B 'browser':70B 'clean':48B 'host':30B 'http':42B 'inject':63B 'malwar':35B 'open':61B 'packag':24B 'page':57B,64B 'plant':54B 'plugin':37B 'quttera':26B,33B 'quttera-threatsign':25B 'run':67B 'scanner':36B 'script':55B,66B 'self':29B 'self-host':28B 'store':40B 'threatsign':27B,34B 'user':44B 'user-ag':43B 'valu':46B 'visitor':52B 'without':47B 'wordpress':31B,39B","search_c":"'4.1.0.48':103C 'access':132C 'administr':131C 'agent':94C 'arbitrari':121C 'attack':118C 'cross':87C 'cross-sit':86C 'due':104C 'escap':111C 'execut':128C 'http':92C 'includ':102C 'inject':120C,134C 'input':107C 'insuffici':106C 'make':113C 'malwar':75C 'output':110C 'page':125C,135C 'paramet':95C 'plugin':79C 'possibl':115C 'quttera':72C 'sanit':108C 'scanner':76C 'script':89C,123C 'site':88C 'store':85C 'threatsign':73C 'unauthent':117C 'user':93C 'version':98C 'via':90C 'vulner':83C 'web':74C,122C 'whenev':129C 'wordpress':78C,81C","first_public_at":"2026-11-07T12:17:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115548","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115548","severity":null,"published_at":"2026-11-07T12:17:42+00:00","modified_at":"2026-11-07T12:17:42+00:00","first_seen_at":"2026-11-07T12:47:08+00:00","fetched_at":"2026-11-07T12:47:08+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115548:2116","url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/quttera-web-malware-scanner/quttera-threatsign-41048-unauthenticated-stored-cross-site-scripting-via-user-agent-header","severity":null,"published_at":"2026-11-07T12:52:34+00:00","modified_at":"2026-11-07T12:52:34+00:00","first_seen_at":"2026-11-07T12:52:34+00:00","fetched_at":"2026-11-07T12:52:34+00:00","note":"Wordfence advisory (CNA, researcher Adrien Brunner) gives affected <= 4.1.0.48, patched 4.1.0.49; WordPress.org changelog shows 4.1.0.52 'Security fixes' but does not name this CVE or 4.1.0.49. Fix version comes from Wordfence, not the vendor's own words, so nothing marked verified. No exploitation or PoC found; did not search social posts (low-profile plugin XSS). NVD page returned no content.","cites":["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/quttera-web-malware-scanner/quttera-threatsign-41048-unauthenticated-stored-cross-site-scripting-via-user-agent-header","https://wordpress.org/plugins/quttera-web-malware-scanner/"]}],"documents":[{"id":95569,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/quttera-web-malware-scanner/quttera-threatsign-41048-unauthenticated-stored-cross-site-scripting-via-user-agent-header","title":"Wordfence: Quttera ThreatSign <= 4.1.0.48 Unauthenticated Stored XSS via User-Agent Header","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":95570,"url":"https://wordpress.org/plugins/quttera-web-malware-scanner/","title":"Quttera ThreatSign plugin page and changelog (WordPress.org)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}