{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-6041", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-04-09T17:12:07.338Z", "datePublished": "2026-04-22T07:45:31.069Z", "dateUpdated": "2026-04-22T07:45:31.069Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-22T07:45:31.069Z"}, "affected": [{"vendor": "mixer2", "product": "Buzz Comments", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "0.9.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Buzz Comments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Custom Buzz Avatar' (buzz_comments_avatar_image) setting in all versions up to, and including, 0.9.4. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the plugin settings page."}], "title": "Buzz Comments <= 0.9.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Custom Buzz Avatar' Setting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1516ebe7-4d16-4e97-9baa-bc5857f95126?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/buzz-comments/trunk/admin.tpl.php#L36"}, {"url": "https://plugins.trac.wordpress.org/browser/buzz-comments/trunk/buzzComments_class.php#L187"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Nur Ibnu Hubab"}], "timeline": [{"time": "2026-04-21T19:03:15.000Z", "lang": "en", "value": "Disclosed"}]}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Buzz Comments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Custom Buzz Avatar' (buzz_comments_avatar_image) setting in all versions up to, and including, 0.9.4. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the plugin settings page."}], "id": "CVE-2026-6041", "lastModified": "2026-04-22T09:16:26.123", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2026-04-22T09:16:26.123", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/buzz-comments/trunk/admin.tpl.php#L36"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/buzz-comments/trunk/buzzComments_class.php#L187"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1516ebe7-4d16-4e97-9baa-bc5857f95126?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T10:06:14.720180+00:00", "value": {"mitigation_remediation": ["Update the Buzz Comments plugin to a version newer than 0.9.4, which removes the vulnerable Custom Buzz Avatar setting or applies proper sanitization.", "Restrict administrator privileges to only those users who truly need them; whenever possible enforce the principle of least privilege for WordPress accounts.", "Implement a Content Security Policy that disallows inline scripts and only permits scripts from trusted sources to mitigate the impact of any remaining stored XSS vectors."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "All installations of the Buzz Comments plugin from mixer2 running versions up to and including 0.9.4 are vulnerable. The plugin is a WordPress add\u2011on and affects WordPress sites that have it installed.", "description_and_impact": "The Buzz Comments plugin for WordPress suffers from insufficient input sanitization and output escaping in the Custom Buzz Avatar setting, allowing an authenticated attacker with administrator privileges to store malicious JavaScript that will execute in any user\u2019s browser when the plugin settings page is visited. This stored cross\u2011site scripting flaw can compromise the integrity of the site\u2019s displayed content. The weakness corresponds to CWE\u201179.", "risk_and_exploitability": "The CVSS base score of 4.4 indicates moderate severity. Because the vulnerability requires authenticated administrator access, the attack surface is limited to users with that role. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating it is not a currently known exploited vulnerability. However, the stored XSS nature means that once injected, the malicious script persists until removed, potentially affecting all users who view the plugin settings page."}}}}, "created": "2026-04-22T10:15:14.509681+00:00", "updated": "2026-04-22T10:15:14.509695+00:00", "vendors": []}