{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4353", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-03-17T17:53:47.917Z", "datePublished": "2026-04-22T07:45:43.152Z", "dateUpdated": "2026-04-22T07:45:43.152Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-22T07:45:43.152Z"}, "affected": [{"vendor": "cihubconnector", "product": "CI HUB Connector", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.2.106", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The CI HUB Connector plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the `cihub_metadata` shortcode in all versions up to, and including, 1.2.106 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "CI HUB Connector <= 1.2.106 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f4b36468-319a-4de3-9112-bd4a3cf7d637?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ci-hub-connector/tags/1.2.106/ci-hub-wordpress-connector.php#L645"}, {"url": "https://plugins.trac.wordpress.org/browser/ci-hub-connector/trunk/ci-hub-wordpress-connector.php#L645"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Djaidja Moundjid"}], "timeline": [{"time": "2026-04-21T19:07:58.000Z", "lang": "en", "value": "Disclosed"}]}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The CI HUB Connector plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the `cihub_metadata` shortcode in all versions up to, and including, 1.2.106 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2026-4353", "lastModified": "2026-04-22T09:16:25.457", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2026-04-22T09:16:25.457", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ci-hub-connector/tags/1.2.106/ci-hub-wordpress-connector.php#L645"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ci-hub-connector/trunk/ci-hub-wordpress-connector.php#L645"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f4b36468-319a-4de3-9112-bd4a3cf7d637?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T09:35:42.891463+00:00", "value": {"mitigation_remediation": ["Upgrade CI HUB Connector to a version newer than 1.2.106, which removes the unsanitized id attribute usage.", "If an upgrade is not feasible, disable or remove the cihub_metadata shortcode from all posts and pages, or delete the plugin entirely.", "Ensure all other shortcodes and content sources enforce strict input validation and output escaping to prevent future XSS vectors, following CWE\u201179 mitigation guidelines."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "WordPress sites that have the CI HUB Connector plugin version 1.2.106 or earlier installed are affected. The issue was present in all releases up to and including 1.2.106.", "description_and_impact": "The vulnerability allows an attacker who has authenticated with Contributor or higher privileges to embed arbitrary scripts into the content of a WordPress page. The injection occurs through the 'id' attribute of the cihub_metadata shortcode, which is not sanitized and is output directly. Once injected, these scripts execute in the browser of any visitor who loads the affected page, leading to theft of session cookies, defacement, or further compromise of the site.", "risk_and_exploitability": "The CVSS score is 6.4, indicating a moderate severity. No EPSS score is available, so the exploitation probability is unknown, but the vulnerability is documented and the attacker needs only Contributor\u2011level access to exploit it. It is not listed in the CISA KEV catalog. Attackers would authenticate and rely on the plugin\u2019s insufficient input validation and lack of output escaping to deliver malicious code."}}}}, "created": "2026-04-22T09:45:13.082053+00:00", "updated": "2026-04-22T09:45:13.082065+00:00", "vendors": []}