---
id: "CVE-2026-115548"
page: "https://infrastack.ai/live/CVE-2026-115548"
kind: "vulnerability"
aliases: ["CVE-2026-115548"]
title: "Quttera ThreatSign WordPress plugin: stored script injection via User-Agent header"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "quttera-web-malware-scanner", "fixed": ["4.1.0.49"], "affected": "<= 4.1.0.48", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["package", "quttera-threatsign", "self-hosted", "wordpress"]
not_affected_if: ["newer-version", "plugin-not-installed"]
published_at: "2026-11-07T12:17:42+00:00"
first_seen_at: "2026-11-07T12:47:08+00:00"
updated_at: "2026-11-07T12:52:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115548", "first_seen_at": "2026-11-07T12:47:08+00:00"}, {"source": "analyst", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/quttera-web-malware-scanner/quttera-threatsign-41048-unauthenticated-stored-cross-site-scripting-via-user-agent-header", "first_seen_at": "2026-11-07T12:52:34+00:00", "cites": ["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/quttera-web-malware-scanner/quttera-threatsign-41048-unauthenticated-stored-cross-site-scripting-via-user-agent-header", "https://wordpress.org/plugins/quttera-web-malware-scanner/"]}]
exploit_sources: []
---

# Quttera ThreatSign WordPress plugin: stored script injection via User-Agent header

Link for people: https://infrastack.ai/live/CVE-2026-115548 (this .md is for agents)

The Quttera ThreatSign malware scanner plugin for WordPress stores the HTTP User-Agent value without cleaning it, so a visitor can plant script in pages. When an administrator opens an injected page, the script runs in their browser.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:quttera-web-malware-scanner affected <= 4.1.0.48 fixed 4.1.0.49

## How to check

- In WordPress admin > Plugins, find Quttera ThreatSign – Web Malware Scanner for WordPress and read its version
- Versions 4.1.0.48 and earlier are affected; 4.1.0.49 or later is patched (per Wordfence)
- Or with WP-CLI: wp plugin get quttera-web-malware-scanner --field=version

## Fix

Update Quttera ThreatSign (quttera-web-malware-scanner) to 4.1.0.49 or later; the WordPress.org changelog currently lists 4.1.0.52 with security fixes.

## Timeline

- 2026-11-07T12:47:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115548
- 2026-11-07T12:52:34+00:00 analyst https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/quttera-web-malware-scanner/quttera-threatsign-41048-unauthenticated-stored-cross-site-scripting-via-user-agent-header — Wordfence advisory (CNA, researcher Adrien Brunner) gives affected <= 4.1.0.48, patched 4.1.0.49; WordPress.org changelog shows 4.1.0.52 'Security fixes' but does not name this CVE or 4.1.0.49. Fix version comes from Wordfence, not the vendor's own words, so nothing marked verified. No exploitation or PoC found; did not search social posts (low-profile plugin XSS). NVD page returned no content.

## Documents

- [advisory] Wordfence: Quttera ThreatSign <= 4.1.0.48 Unauthenticated Stored XSS via User-Agent Header https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/quttera-web-malware-scanner/quttera-threatsign-41048-unauthenticated-stored-cross-site-scripting-via-user-agent-header
- [fix] Quttera ThreatSign plugin page and changelog (WordPress.org) https://wordpress.org/plugins/quttera-web-malware-scanner/

## From the sources

The Quttera ThreatSign – Web Malware Scanner for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_USER_AGENT' parameter in all versions up to, and including, 4.1.0.48 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator accesses an injected page.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_