Cross-site scripting in rafasashi Custom New User Notification
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- High
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
The Custom New User Notification plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's admin settings in all versions up to, and including, 1.2.0. This is due to insufficient input sanitization and output escaping on multiple settings fields including 'User Mail Subject', 'User From Name', 'User From Email', 'Admin Mail Subject', 'Admin From Name', and 'Admin From Email'. The settings are registered via register_setting() without sanitize callbacks, and the values retrieved via get_option() are echoed directly into HTML input value attributes without esc_attr(). This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in the plugin settings page that will execute whenever a user accesses that page. This could be used in multi-site installations where administrators of subsites could target super administrators.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-3551
- 2026-10-03 Alias added: GHSA-4xx2-h7jh-g7ph
References
Other 17
- https://www.wordfence.com/threat-intel/vulnerabilities/id/7a14d35d-144c-4ddd-b288-5e0e006fb165?source=cve
- https://plugins.trac.wordpress.org/browser/custom-new-user-notification/trunk/admin/includes.php#L46
- https://plugins.trac.wordpress.org/browser/custom-new-user-notification/tags/1.2.0/admin/includes.php#L46
- https://plugins.trac.wordpress.org/browser/custom-new-user-notification/trunk/admin/includes.php#L52
- https://plugins.trac.wordpress.org/browser/custom-new-user-notification/tags/1.2.0/admin/includes.php#L52
- https://plugins.trac.wordpress.org/browser/custom-new-user-notification/trunk/admin/includes.php#L59
- https://plugins.trac.wordpress.org/browser/custom-new-user-notification/tags/1.2.0/admin/includes.php#L59
- https://plugins.trac.wordpress.org/browser/custom-new-user-notification/trunk/admin/includes.php#L84
- https://plugins.trac.wordpress.org/browser/custom-new-user-notification/tags/1.2.0/admin/includes.php#L84
- https://plugins.trac.wordpress.org/browser/custom-new-user-notification/trunk/admin/includes.php#L90
- https://plugins.trac.wordpress.org/browser/custom-new-user-notification/tags/1.2.0/admin/includes.php#L90
- https://plugins.trac.wordpress.org/browser/custom-new-user-notification/trunk/admin/includes.php#L97
- https://plugins.trac.wordpress.org/browser/custom-new-user-notification/tags/1.2.0/admin/includes.php#L97
- https://plugins.trac.wordpress.org/browser/custom-new-user-notification/trunk/admin/includes.php#L132
- https://plugins.trac.wordpress.org/browser/custom-new-user-notification/tags/1.2.0/admin/includes.php#L132
- https://plugins.trac.wordpress.org/browser/custom-new-user-notification/trunk/custom-new-user-notification.php#L63
- https://plugins.trac.wordpress.org/browser/custom-new-user-notification/tags/1.2.0/custom-new-user-notification.php#L63
More rafasashi vulnerabilities
- TI-2026-12911 Improper authentication in rafasashi User Session Synchronizer CVSS 3.1CRITICAL 9.8
- TI-2025-23677 WordPress User Session Synchronizer plugin <= 1.4.0 - CSRF to Stored XSS vulnerability CVSS 3.1HIGH 7.1
- TI-2024-33134 WordPress SVG Captcha plugin <= 1.0.11 - Reflected Cross Site Scripting (XSS) vulnerability CVSS 3.1HIGH 7.1
- TI-2024-33128 WordPress Todo Custom Field plugin <= 3.0.4 - Reflected Cross Site Scripting (XSS) vulnerability CVSS 3.1HIGH 7.1
- TI-2024-08915 Language Switcher <= 3.7.13 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
Sources
- CVE-2026-3551 · CVE Program
- CVE-2026-3551 · NVD
- FIRST EPSS
- GHSA-4xx2-h7jh-g7ph · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences