Taskbuilder <= 5.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Block Emails' Field
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- High
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
The Taskbuilder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| taskbuilder | Taskbuilder – Project Management & Task Management Tool With Kanban Board | up to 5.0.3 | — | No fix listed | CNA |
- Taskbuilder – Project Management & Task Management Tool With Kanban Board Vendortaskbuilder Affected up to 5.0.3 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-2289
- 2026-10-03 Alias added: GHSA-g2p2-cwqf-v437
References
Other 6
- https://www.wordfence.com/threat-intel/vulnerabilities/id/81e26924-c9eb-4ddf-89e3-a8bf95d23b78?source=cve
- https://plugins.trac.wordpress.org/browser/taskbuilder/trunk/includes/admin/email_notifications/wppm_get_en_general_setting.php#L30
- https://plugins.trac.wordpress.org/browser/taskbuilder/tags/5.0.1/includes/admin/email_notifications/wppm_get_en_general_setting.php#L30
- https://plugins.trac.wordpress.org/browser/taskbuilder/trunk/includes/class-wppm-functions.php#L19
- https://plugins.trac.wordpress.org/browser/taskbuilder/tags/5.0.1/includes/class-wppm-functions.php#L19
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3468819%40taskbuilder&new=3468819%40taskbuilder&sfp_email=&sfph_mail=
More taskbuilder vulnerabilities
- TI-2024-09124 Taskbuilder < 3.0.9 - Admin+ SQL Injection CVSS 3.1HIGH 7.2
- TI-2024-09121 Taskbuilder < 3.0.5 - Admin+ SQL Injection CVSS 3.1MEDIUM 4.1
- TI-2025-16598 WordPress Taskbuilder Plugin <= 3.0.6 - SQL Injection vulnerability CVSS 3.1HIGH 8.8
- TI-2026-37822 WordPress Taskbuilder plugin <= 5.0.7 - SQL Injection vulnerability CVSS 3.1HIGH 8.5
- TI-2025-26311 WordPress Taskbuilder plugin <= 4.0.1 - SQL Injection Vulnerability CVSS 3.1HIGH 8.5
- TI-2026-69938 Blind SQL injection in WordPress Taskbuilder plugin CVSS 3.1HIGH 8.5
Sources
- CVE-2026-2289 · CVE Program
- CVE-2026-2289 · NVD
- FIRST EPSS
- GHSA-g2p2-cwqf-v437 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences