{"id":"CVE-2026-119490","kind":"vulnerability","aliases":["CVE-2026-119490"],"related":[],"title":"Better Notifications for WP: XSS lets attackers inject script into pages","description":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Made with Fuel Ltd. Better Notifications for WP bnfw allows Code Injection.This issue affects Better Notifications for WP: from n/a through 1.10.1.","summary":"Better Notifications for WP (bnfw), a WordPress plugin from Made with Fuel Ltd, does not neutralize script-related HTML tags, so it allows code injection. An attacker who can supply input the plugin renders could run JavaScript in a user's browser.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bnfw","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version of Better Notifications for WP (bnfw) in the WordPress admin under Plugins; affected versions are up to and including `1.10.1`.","fix":"- Better Notifications for WP (bnfw): move to a version later than `1.10.1`; the sources do not name the exact fixed version.","status":"open","published_at":"2026-11-07T11:16:58+00:00","first_seen_at":"2026-11-07T11:46:52+00:00","triaged_at":"2026-11-07T11:48:34+00:00","updated_at":"2026-11-07T11:48:34+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-07T11:48:34Z","model":"claude-haiku-5-5","output":{"fix":"- Better Notifications for WP (bnfw): move to a version later than `1.10.1`; the sources do not name the exact fixed version.","reach":"unknown","title":"Better Notifications for WP: XSS lets attackers inject script into pages","impact":"medium","summary":"Better Notifications for WP (bnfw), a WordPress plugin from Made with Fuel Ltd, does not neutralize script-related HTML tags, so it allows code injection. An attacker who can supply input the plugin renders could run JavaScript in a user's browser.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","bnfw","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in visitors' or admins' browsers on the site","analyst_note":"Check the NVD entry and the plugin changelog for the fixed version and the vulnerable input path.","how_to_check":"- Check the installed plugin version of Better Notifications for WP (bnfw) in the WordPress admin under Plugins; affected versions are up to and including `1.10.1`.\n- unknown for further checks; the sources do not say which input fields are affected.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Better Notifications for WP (bnfw) WordPress plugin at version 1.10.1 or earlier. The sources do not say which settings or roles make it exploitable, so unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000709,"input_tokens":4239,"output_tokens":570,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119490':14A,17A '-2026':13A,16A '1.10.1':104C 'affect':96C 'allow':47B,92C 'attack':7A,51B 'basic':79C 'better':1A,24B,87C,97C 'bnfw':18B,28B,91C 'browser':66B 'code':48B,93C 'could':59B 'cve':12A,15A 'fuel':35B,85C 'host':22B 'html':43B,73C 'improp':67C 'inject':8A,49B 'injection.this':94C 'input':55B 'issu':95C 'javascript':61B 'let':6A 'ltd':36B,86C 'made':33B,83C 'n/a':102C 'neutral':39B,68C 'notif':2A,25B,88C,98C 'packag':19B 'page':11A,78C 'plugin':31B,57B 'relat':42B,72C 'render':58B 'run':60B 'script':9A,41B,71C 'script-rel':40B,70C 'self':21B 'self-host':20B 'suppli':54B 'tag':44B,74C 'user':64B 'vulner':81C 'web':77C 'wordpress':23B,30B 'wp':4A,27B,90C,100C 'xss':5A,80C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Better Notifications for WP (bnfw) WordPress plugin at version 1.10.1 or earlier. The sources do not say which settings or roles make it exploitable, so unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bnfw","medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-119490':14A,17A '-2026':13A,16A 'attack':7A 'better':1A 'cve':12A,15A 'inject':8A 'let':6A 'notif':2A 'page':11A 'script':9A 'wp':4A 'xss':5A","search_b":"'allow':47B 'attack':51B 'better':24B 'bnfw':18B,28B 'browser':66B 'code':48B 'could':59B 'fuel':35B 'host':22B 'html':43B 'inject':49B 'input':55B 'javascript':61B 'ltd':36B 'made':33B 'neutral':39B 'notif':25B 'packag':19B 'plugin':31B,57B 'relat':42B 'render':58B 'run':60B 'script':41B 'script-rel':40B 'self':21B 'self-host':20B 'suppli':54B 'tag':44B 'user':64B 'wordpress':23B,30B 'wp':27B","search_c":"'1.10.1':104C 'affect':96C 'allow':92C 'basic':79C 'better':87C,97C 'bnfw':91C 'code':93C 'fuel':85C 'html':73C 'improp':67C 'injection.this':94C 'issu':95C 'ltd':86C 'made':83C 'n/a':102C 'neutral':68C 'notif':88C,98C 'page':78C 'relat':72C 'script':71C 'script-rel':70C 'tag':74C 'vulner':81C 'web':77C 'wp':90C,100C 'xss':80C","first_public_at":"2026-11-07T11:16:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119490","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119490","severity":null,"published_at":"2026-11-07T11:16:58+00:00","modified_at":"2026-11-07T11:16:58+00:00","first_seen_at":"2026-11-07T11:46:52+00:00","fetched_at":"2026-11-07T11:46:52+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}