{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1278", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-20T22:08:30.988Z", "datePublished": "2026-03-21T03:27:11.384Z", "dateUpdated": "2026-04-08T17:29:10.782Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:29:10.782Z"}, "affected": [{"vendor": "ketanmujumdar", "product": "Mandatory Field", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.6.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Mandatory Field plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.6.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "title": "Mandatory Field <= 1.6.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Fields", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e262ec15-420a-4f52-90e0-e4a2e28402a1?source=cve"}, {"url": "https://downloads.wordpress.org/plugin/mandatory-fields.1.6.8.zip"}, {"url": "https://wordpress.org/plugins/mandatory-fields/"}, {"url": "https://plugins.trac.wordpress.org/browser/mandatory-fields/trunk/mandatory-plugin-option-page.php#L14"}, {"url": "https://plugins.trac.wordpress.org/browser/mandatory-fields/tags/1.6.8/mandatory-plugin-option-page.php#L14"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Bhumividh Treloges"}], "timeline": [{"time": "2026-03-20T15:20:13.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-24T14:00:14.190940Z", "id": "CVE-2026-1278", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T14:00:28.096Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1278", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-24T14:00:14.190940Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T14:00:21.200Z"}}], "cna": {"title": "Mandatory Field <= 1.6.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Fields", "credits": [{"lang": "en", "type": "finder", "value": "Bhumividh Treloges"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "ketanmujumdar", "product": "Mandatory Field", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.6.8"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-03-20T15:20:13.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e262ec15-420a-4f52-90e0-e4a2e28402a1?source=cve"}, {"url": "https://downloads.wordpress.org/plugin/mandatory-fields.1.6.8.zip"}, {"url": "https://wordpress.org/plugins/mandatory-fields/"}, {"url": "https://plugins.trac.wordpress.org/browser/mandatory-fields/trunk/mandatory-plugin-option-page.php#L14"}, {"url": "https://plugins.trac.wordpress.org/browser/mandatory-fields/tags/1.6.8/mandatory-plugin-option-page.php#L14"}], "descriptions": [{"lang": "en", "value": "The Mandatory Field plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.6.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:29:10.782Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1278", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:29:10.782Z", "dateReserved": "2026-01-20T22:08:30.988Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-21T03:27:11.384Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Mandatory Field plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.6.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}, {"lang": "es", "value": "El plugin Mandatory Field para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s de la configuraci\u00f3n de administrador en todas las versiones hasta la 1.6.8, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto hace posible que atacantes autenticados, con permisos de nivel de administrador y superiores, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada. Esto solo afecta a las instalaciones multisitio y a las instalaciones donde se ha deshabilitado unfiltered_html."}], "id": "CVE-2026-1278", "lastModified": "2026-04-22T21:32:08.360", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2026-03-21T04:16:52.437", "references": [{"source": "security@wordfence.com", "url": "https://downloads.wordpress.org/plugin/mandatory-fields.1.6.8.zip"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/mandatory-fields/tags/1.6.8/mandatory-plugin-option-page.php#L14"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/mandatory-fields/trunk/mandatory-plugin-option-page.php#L14"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/mandatory-fields/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e262ec15-420a-4f52-90e0-e4a2e28402a1?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.6.8]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Mandatory Field", "source": "cna", "vendor": "ketanmujumdar"}, "product": "mandatory_field", "vendor": "ketanmujumdar"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-21T06:20:25.127691+00:00", "value": {"mitigation_remediation": ["Update the Mandatory Field plugin to the latest version that removes the stored XSS flaw.", "Ensure that only trusted administrators have the ability to edit plugin settings and that the unfiltered_html feature remains disabled for all other roles.", "Review any existing configuration values for embedded script tags and remove or sanitize them.", "Monitor site activity for signs of injected scripts or unexpected behavior, and consider running a web application firewall that blocks script injection."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The problem exists in all releases of the Mandatory Field plugin up to and including version 1.6.8. It impacts WordPress multi\u2011site installations or single sites where the unfiltered_html capability is turned off, and only attackers who can log in as administrator or higher can abuse the flaw.", "description_and_impact": "The Mandatory Field plugin for WordPress allows authenticated administrators to store malicious scripts in the plugin\u2019s settings, which are then rendered on any page that includes those settings. The vulnerability is a classic stored XSS flaw (CWE\u201179) that can lead to session hijacking, defacement, or the execution of arbitrary code within the context of site visitors. No external file downloads or network exploits are required; the weakness resides in the server\u2011side processing of admin input.", "risk_and_exploitability": "The CVSS score of 4.4 indicates moderate severity. The advisory does not list an exploitation probability score, and the issue is not in the CISA KEV catalog. The likely attack vector is an authenticated administrator performing normal configuration changes; exploitation requires no additional lateral movement or privilege escalation beyond the existing admin role."}}}}, "created": "2026-03-23T09:49:47.057238+00:00", "updated": "2026-03-25T14:41:26.254375+00:00", "vendors": ["ketanmujumdar", "ketanmujumdar$PRODUCT$mandatory_field", "wordpress", "wordpress$PRODUCT$wordpress"]}