PT-2026-22093 · WordPress · Tp2Wp Importer

Ibnu + 1 · Publicado 2026-02-26 · Atualizado 2026-02-26 · CVE-2026-2489

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Média

Vetor base

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TP2WP Importer plugin for WordPress versions up to and including 1.1

Description The software is susceptible to Stored Cross-Site Scripting through the 'Watched domains' textarea on the attachment importer settings page. This is caused by inadequate input sanitization and output escaping when domains are saved using AJAX and rendered with echo implode() without esc textarea(). Authenticated attackers with Administrator-level access or higher can inject arbitrary web scripts into pages that execute when a user accesses the attachment importer settings page. The vulnerable parameter is Watched domains.

Recommendations Update the TP2WP Importer plugin to a version beyond 1.1.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-2489

Produtos afetados

Tp2Wp Importer

Referências · 6

• https://plugins.trac.wordpress.org/browser/tp2wp-importer/tags/1.1/attachments/templates/page.php#L28 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/4eacf7b7-100b-423d-920f-14f3e33f5f60?source=cve · Nota
• https://twitter.com/CVEnew/status/2027004221862650292 · Publicação no Twitter
• https://t.me/CVEtracker/45816 · Publicação no Telegram
• https://plugins.trac.wordpress.org/browser/tp2wp-importer/trunk/attachments/templates/page.php#L28 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-2489 · Nota de Segurança