CVE-2026-6041
Stored XSS in Buzz Comments WordPress Plugin Allows Admin Script Injection
Publication date: 2026-04-22
Last updated on: 2026-04-22
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| buzz_comments | plugin | to 0.9.4 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows authenticated attackers with Administrator-level access to inject arbitrary web scripts via stored cross-site scripting in the Buzz Comments plugin. This can lead to unauthorized access or manipulation of data within the WordPress environment.
Such unauthorized script execution and potential data exposure could impact compliance with standards and regulations like GDPR and HIPAA, which require protection of personal data and secure handling of user information.
However, the provided information does not explicitly detail the direct compliance implications or specific regulatory impacts.
Can you explain this vulnerability to me?
The Buzz Comments plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in the 'Custom Buzz Avatar' setting (buzz_comments_avatar_image). This vulnerability exists in all versions up to and including 0.9.4 due to insufficient input sanitization and output escaping.
Authenticated users with Administrator-level access or higher can exploit this vulnerability by injecting arbitrary web scripts into the plugin settings page. These scripts will execute whenever any user accesses that page.
How can this vulnerability impact me? :
This vulnerability allows attackers with Administrator-level access to inject malicious scripts that execute in the context of the plugin settings page.
The impact includes potential compromise of user sessions, theft of sensitive information, or manipulation of the plugin settings, which could lead to further security breaches.
However, the CVSS score indicates a moderate severity (4.4) with low impact on confidentiality and integrity, and no impact on availability.