CVE-2026-6041

Received Received - Intake

Stored XSS in Buzz Comments WordPress Plugin Allows Admin Script Injection

Publication date: 2026-04-22

Last updated on: 2026-04-22

Assigner: Wordfence

Description

The Buzz Comments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Custom Buzz Avatar' (buzz_comments_avatar_image) setting in all versions up to, and including, 0.9.4. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the plugin settings page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-22

Last Modified

2026-04-22

Generated

2026-07-06

AI Q&A

2026-04-23

EPSS Evaluated

2026-07-05

NVD

CVE-2026-6041

EUVD

EUVD-2026-24698

Affected Vendors & Products

Vendor	Product	Version / Range
buzz_comments	plugin	to 0.9.4 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Compliance Impact

The vulnerability allows authenticated attackers with Administrator-level access to inject arbitrary web scripts via stored cross-site scripting in the Buzz Comments plugin. This can lead to unauthorized access or manipulation of data within the WordPress environment.

Such unauthorized script execution and potential data exposure could impact compliance with standards and regulations like GDPR and HIPAA, which require protection of personal data and secure handling of user information.

However, the provided information does not explicitly detail the direct compliance implications or specific regulatory impacts.

Executive Summary

The Buzz Comments plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in the 'Custom Buzz Avatar' setting (buzz_comments_avatar_image). This vulnerability exists in all versions up to and including 0.9.4 due to insufficient input sanitization and output escaping.

Authenticated users with Administrator-level access or higher can exploit this vulnerability by injecting arbitrary web scripts into the plugin settings page. These scripts will execute whenever any user accesses that page.

Impact Analysis

This vulnerability allows attackers with Administrator-level access to inject malicious scripts that execute in the context of the plugin settings page.

The impact includes potential compromise of user sessions, theft of sensitive information, or manipulation of the plugin settings, which could lead to further security breaches.

However, the CVSS score indicates a moderate severity (4.4) with low impact on confidentiality and integrity, and no impact on availability.

Hi! I’m here to help you understand CVE-2026-6041. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70