{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1263", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-20T21:18:05.973Z", "datePublished": "2026-04-10T01:24:59.121Z", "dateUpdated": "2026-04-10T01:24:59.121Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-10T01:24:59.121Z"}, "affected": [{"vendor": "usystemsgmbh", "product": "Webling", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.9.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Webling plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.9.0 due to insufficient input sanitization, insufficient output escaping, and missing capabilities checks in the 'webling_admin_save_form' and 'webling_admin_save_memberlist' functions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject Webling forms and memberlists with arbitrary web scripts that will execute whenever an administrator views the related form or memberlist area of the WordPress admin."}], "title": "Webling <= 3.9.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'title' Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bd8fbe0d-0709-4fa2-9294-393ddcd05b22?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/webling/tags/3.9.0/src/admin/lists/Form_List.php#L122"}, {"url": "https://plugins.trac.wordpress.org/browser/webling/tags/3.9.0/src/admin/lists/Memberlist_List.php#L115"}, {"url": "https://plugins.trac.wordpress.org/browser/webling/tags/3.9.0/src/admin/actions/save_form.php#L2"}, {"url": "https://plugins.trac.wordpress.org/browser/webling/tags/3.9.0/src/admin/actions/save_memberlist.php#L2"}, {"url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fwebling/tags/3.9.0&new_path=%2Fwebling/tags/3.9.1"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Kate Kligman"}], "timeline": [{"time": "2026-04-09T12:32:40.000Z", "lang": "en", "value": "Disclosed"}]}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Webling plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.9.0 due to insufficient input sanitization, insufficient output escaping, and missing capabilities checks in the 'webling_admin_save_form' and 'webling_admin_save_memberlist' functions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject Webling forms and memberlists with arbitrary web scripts that will execute whenever an administrator views the related form or memberlist area of the WordPress admin."}], "id": "CVE-2026-1263", "lastModified": "2026-04-10T02:16:02.083", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2026-04-10T02:16:02.083", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/webling/tags/3.9.0/src/admin/actions/save_form.php#L2"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/webling/tags/3.9.0/src/admin/actions/save_memberlist.php#L2"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/webling/tags/3.9.0/src/admin/lists/Form_List.php#L122"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/webling/tags/3.9.0/src/admin/lists/Memberlist_List.php#L115"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fwebling/tags/3.9.0&new_path=%2Fwebling/tags/3.9.1"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bd8fbe0d-0709-4fa2-9294-393ddcd05b22?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.9.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Webling", "source": "cna", "vendor": "usystemsgmbh"}, "product": "webling", "vendor": "usystemsgmbh"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-10T02:22:23.274047+00:00", "value": {"mitigation_remediation": ["Update the Webling plugin to version 3.9.1 or later as released by the vendor", "Verify that all user accounts with Subscriber or higher roles have not been compromised; consider temporarily deactivating suspicious accounts", "Review all existing forms and member lists for injected scripts and remove any suspicious code", "Apply the highest available WordPress user capabilities checks to prevent unauthorized editing of plugin data"], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting that executes in the administrator context by authenticated users"}, "threat_synthesis": {"affected_systems": "WordPress sites that have the Webling plugin from usystemsgmbh installed in any version up to and including 3.9.0 are affected. No newer versions are listed as vulnerable, so sites using 3.9.1 or later are not impacted.", "description_and_impact": "The vulnerability allows a subscriber\u2011level or higher account to submit JavaScript through the \"title\" field of Webling forms or member lists. The injected code is stored and later rendered when an administrator views the affected form or list, resulting in client\u2011side script execution that runs with the administrator\u2019s privileges. Such execution can lead to theft of admin session cookies, defacement, or further exploitation of the site.", "risk_and_exploitability": "The CVSS score is 6.4, indicating moderate severity. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires an authenticated user with Subscriber or higher privileges who can edit a form or member list via the plugin\u2019s admin interface; no special network or local access is required beyond standard web interaction with the WordPress admin area."}}}}, "created": "2026-04-10T08:36:10.956598+00:00", "updated": "2026-04-10T09:27:10.536982+00:00", "vendors": ["usystemsgmbh", "usystemsgmbh$PRODUCT$webling", "wordpress", "wordpress$PRODUCT$wordpress"]}