{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2432", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-12T21:17:51.101Z", "datePublished": "2026-03-20T08:25:58.769Z", "dateUpdated": "2026-03-20T08:25:58.769Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-03-20T08:25:58.769Z"}, "affected": [{"vendor": "creativemindssolutions", "product": "CM Custom Reports \u2013 Flexible reporting to track what matters most", "versions": [{"version": "*", "status": "affected", "lessThanOrEqual": "1.2.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The CM Custom Reports \u2013 Flexible reporting to track what matters most plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "title": "CM Custom Reports <= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Labels", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e642b5e1-62c1-4aa9-b579-6b2338227dd5?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/cm-custom-reports/trunk/backend/classes/modules/GraphModule.php#L151"}, {"url": "https://plugins.trac.wordpress.org/browser/cm-custom-reports/tags/1.2.7/backend/classes/modules/GraphModule.php#L151"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3464005%40cm-custom-reports&new=3464005%40cm-custom-reports&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "san6051"}], "timeline": [{"time": "2026-02-12T21:33:02.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-03-19T19:57:41.000Z", "lang": "en", "value": "Disclosed"}]}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The CM Custom Reports \u2013 Flexible reporting to track what matters most plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "id": "CVE-2026-2432", "lastModified": "2026-03-20T09:16:14.327", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2026-03-20T09:16:14.327", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/cm-custom-reports/tags/1.2.7/backend/classes/modules/GraphModule.php#L151"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/cm-custom-reports/trunk/backend/classes/modules/GraphModule.php#L151"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3464005%40cm-custom-reports&new=3464005%40cm-custom-reports&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e642b5e1-62c1-4aa9-b579-6b2338227dd5?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-03-20T09:50:48.275487+00:00", "value": {"mitigation_remediation": ["Update the CM Custom Reports plugin to a version newer than 1.2.7", "If an update is not available, deactivate or uninstall the CM Custom Reports plugin to eliminate the vulnerable code", "Restrict administrator\u2011level accounts to only those necessary", "Monitor dashboards and reports for unexpected scripts or injected content", "Implement a content security policy that disallows inline scripts to mitigate the impact of any remaining vulnerabilities"], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "Creative Minds Solutions; All installations of the CM Custom Reports plugin up to and including version\u202f1.2.7 are affected. The vulnerability exists only on multi\u2011site WordPress installations where the unfiltered_html capability is disabled, and requires that an authenticated administrator has access to the plugin\u2019s admin settings.", "description_and_impact": "The CM Custom Reports \u2013 Flexible reporting to track what matters most plugin for WordPress contains a stored XSS flaw. Key detail from vendor description: \"The CM Custom Reports \u2013 Flexible reporting to track what matters most plugin for WordPress is vulnerable to Stored Cross\u2011Site Scripting via admin settings in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping.\" An attacker with administrator\u2011level permissions can inject arbitrary web scripts into plugin settings that will execute whenever a user accesses an injected page. This allows session hijacking, credential theft, or defacement of reports and dashboard pages.", "risk_and_exploitability": "The CVSS score of 4.4 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated administrator\u2011level access and insertion of malicious code via the plugin\u2019s label field. The attack vector is internal to the site but can impact all users who view reports, potentially compromising confidentiality, integrity, and availability of user sessions."}}}}, "created": "2026-03-20T10:36:33.864381+00:00", "updated": "2026-03-20T10:36:33.864441+00:00", "vendors": []}