{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1913", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-04T15:37:47.705Z", "datePublished": "2026-04-22T09:27:20.844Z", "dateUpdated": "2026-04-22T09:27:20.844Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-22T09:27:20.844Z"}, "affected": [{"vendor": "gallagherwebsitedesign", "product": "Gallagher Website Design", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.6.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Gallagher Website Design plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's login_link shortcode in all versions up to, and including, 2.6.4 due to insufficient input sanitization and output escaping on the 'prefix' attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Gallagher Website Design <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'prefix' Shortcode Attribute", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d8d013ae-a512-454a-bcfc-8725a6928fee?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/gallagher-website-design/trunk/gallagher-website-design.php#L203"}, {"url": "https://plugins.trac.wordpress.org/browser/gallagher-website-design/tags/2.6.4/gallagher-website-design.php#L203"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3454227%40gallagher-website-design&new=3454227%40gallagher-website-design&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Djaidja Moundjid"}], "timeline": [{"time": "2026-04-21T20:36:56.000Z", "lang": "en", "value": "Disclosed"}]}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Gallagher Website Design plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's login_link shortcode in all versions up to, and including, 2.6.4 due to insufficient input sanitization and output escaping on the 'prefix' attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2026-1913", "lastModified": "2026-04-22T10:16:50.853", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2026-04-22T10:16:50.853", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/gallagher-website-design/tags/2.6.4/gallagher-website-design.php#L203"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/gallagher-website-design/trunk/gallagher-website-design.php#L203"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3454227%40gallagher-website-design&new=3454227%40gallagher-website-design&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d8d013ae-a512-454a-bcfc-8725a6928fee?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T10:51:21.157237+00:00", "value": {"mitigation_remediation": ["Upgrade the Gallagher Website Design plugin to a version later than 2.6.4, if available, to apply the vendor\u2019s fix for the XSS bug.", "If no newer version exists, remove or disable the login_link shortcode from public posts to prevent the injection vector.", "Ensure that only trusted users have Contributor or higher privileges, and audit user roles to reduce the risk of malicious payload submission.", "Implement a site\u2011wide input sanitization layer or web application firewall rule that blocks malicious scripts in content added via the prefix attribute."], "summary": {"action": "Patch Up", "impact": "Stored Cross\u2011Site Scripting (XSS) leading to arbitrary script execution"}, "threat_synthesis": {"affected_systems": "The Gallagher Website Design WordPress plugin, all releases up to and including version 2.6.4. Systems employing this plugin on a WordPress installation are potentially vulnerable if users can create or edit content using the login_link shortcode.", "description_and_impact": "The plugin allows stored XSS through its login_link shortcode. An authenticated user with Contributor or higher privileges can supply a value for the prefix attribute that is stored and later rendered without proper sanitization. The injected payload executes in the browser context whenever a page containing the shortcode is viewed, providing a vector for session hijacking, defacement, or theft of credentials. The weakness is a classic reflected/embedded XSS flaw, catalogued as CWE\u201179.", "risk_and_exploitability": "The CVSS score of 6.4 indicates a moderate severity vulnerability. Because the bug requires authenticated access at the Contributor level or higher, attackers must first gain or already possess such permissions. No EPSS information is available, and the issue is not listed in CISA\u2019s KEV catalog, suggesting limited known exploitation. Nonetheless, the stored nature of the flaw means any authenticated user can place harmful scripts that will run for all other site visitors. The absence of an official fix in the provided data means administrators should treat this as a high\u2011priority mitigation."}}}}, "created": "2026-04-22T11:00:09.088336+00:00", "updated": "2026-04-22T11:00:09.088349+00:00", "vendors": []}