{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2292", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-10T15:44:41.209Z", "datePublished": "2026-03-04T01:21:59.646Z", "dateUpdated": "2026-04-08T17:25:14.151Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:25:14.151Z"}, "affected": [{"vendor": "bandido", "product": "Morkva UA Shipping", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.7.9", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Morkva UA Shipping plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "title": "Morkva UA Shipping <= 1.7.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Weight, kg' Field", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d1f51f00-9991-49b3-950a-4a12667991e4?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/morkva-ua-shipping/trunk/classes/settings/global/mrkv-ua-shipping-option-fields.php#L66"}, {"url": "https://plugins.trac.wordpress.org/browser/morkva-ua-shipping/tags/1.7.6/classes/settings/global/mrkv-ua-shipping-option-fields.php#L66"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3468486%40morkva-ua-shipping&new=3468486%40morkva-ua-shipping&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Phap Nguyen Anh"}], "timeline": [{"time": "2026-02-10T15:59:56.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-03-03T12:44:45.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-04T16:05:01.240707Z", "id": "CVE-2026-2292", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T16:05:14.039Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2292", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-04T16:05:01.240707Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T16:05:07.584Z"}}], "cna": {"title": "Morkva UA Shipping <= 1.7.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Weight, kg' Field", "credits": [{"lang": "en", "type": "finder", "value": "Phap Nguyen Anh"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "bandido", "product": "Morkva UA Shipping", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.7.9"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-10T15:59:56.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-03-03T12:44:45.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d1f51f00-9991-49b3-950a-4a12667991e4?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/morkva-ua-shipping/trunk/classes/settings/global/mrkv-ua-shipping-option-fields.php#L66"}, {"url": "https://plugins.trac.wordpress.org/browser/morkva-ua-shipping/tags/1.7.6/classes/settings/global/mrkv-ua-shipping-option-fields.php#L66"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3468486%40morkva-ua-shipping&new=3468486%40morkva-ua-shipping&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Morkva UA Shipping plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:25:14.151Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2292", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:25:14.151Z", "dateReserved": "2026-02-10T15:44:41.209Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-04T01:21:59.646Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Morkva UA Shipping plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}, {"lang": "es", "value": "El plugin Morkva UA Shipping para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s de la configuraci\u00f3n de administrador en todas las versiones hasta la 1.7.9, inclusive, debido a la sanitizaci\u00f3n insuficiente de la entrada y al escape de la salida. Esto hace posible que atacantes autenticados, con permisos de nivel de administrador y superiores, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada. Esto solo afecta a instalaciones multisitio y a las instalaciones donde se ha deshabilitado unfiltered_html."}], "id": "CVE-2026-2292", "lastModified": "2026-04-22T21:26:58.303", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2026-03-04T02:15:54.490", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/morkva-ua-shipping/tags/1.7.6/classes/settings/global/mrkv-ua-shipping-option-fields.php#L66"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/morkva-ua-shipping/trunk/classes/settings/global/mrkv-ua-shipping-option-fields.php#L66"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3468486%40morkva-ua-shipping&new=3468486%40morkva-ua-shipping&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d1f51f00-9991-49b3-950a-4a12667991e4?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.7.9]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Morkva UA Shipping", "source": "cna", "vendor": "bandido"}, "product": "morkva_ua_shipping", "vendor": "bandido"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T17:56:53.470761+00:00", "value": {"mitigation_remediation": ["Upgrade the bandido Morkva UA Shipping plugin to the latest release that includes input sanitization and output escaping for the Weight, kg field.", "Restrict administrator\u2011level access to trusted personnel and audit existing admin accounts for compromise.", "If an immediate upgrade is not possible, implement a custom filter that removes or escapes script tags from the Weight, kg field in compliance with CWE\u201179 best practices, or disable unfiltered_html to prevent script injection."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "All releases of bandido\u2019s Morkva UA Shipping WordPress plugin up to and including version 1.7.9 are vulnerable. The flaw applies to multi\u2011site installations and only to sites where the unfiltered_html capability is disabled. WordPress sites that employ this plugin with administrator or higher privileges are at risk until the defect is patched.", "description_and_impact": "The Morkva UA Shipping plugin accepts user input in the \"Weight, kg\" field without proper sanitization or escaping, allowing an authenticated administrator to store arbitrary JavaScript that executes when any visitor loads a page rendering that field. This stored XSS can hijack user sessions, deface content, or redirect users to malicious sites.", "risk_and_exploitability": "The CVSS Base score of 4.4 indicates a low to moderate impact, and the EPSS score of less than 1\u202f% suggests a very low probability of exploitation in the near term. The vulnerability is not listed in CISA\u2019s KEV catalog. An attacker must be authenticated as an administrator or higher to inject the script, and the stored payload is subsequently executed for all visitors who view the affected page, enabling session hijacking, defacement, or redirection."}}}}, "created": "2026-03-04T14:53:23.854041+00:00", "updated": "2026-04-15T18:00:15.504395+00:00", "vendors": ["bandido", "bandido$PRODUCT$morkva_ua_shipping", "wordpress", "wordpress$PRODUCT$wordpress"]}