PT-2026-22093 · WordPress · Tp2Wp Importer

Ibnu + 1 · Published 2026-02-26 · Updated 2026-02-26 · CVE-2026-2489

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TP2WP Importer plugin for WordPress versions up to and including 1.1

Description The software is susceptible to Stored Cross-Site Scripting through the 'Watched domains' textarea on the attachment importer settings page. This is caused by inadequate input sanitization and output escaping when domains are saved using AJAX and rendered with echo implode() without esc textarea(). Authenticated attackers with Administrator-level access or higher can inject arbitrary web scripts into pages that execute when a user accesses the attachment importer settings page. The vulnerable parameter is Watched domains.

Recommendations Update the TP2WP Importer plugin to a version beyond 1.1.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-2489

Affected Products

Tp2Wp Importer

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-2489 · Security Note
• https://plugins.trac.wordpress.org/browser/tp2wp-importer/tags/1.1/attachments/templates/page.php#L28 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/4eacf7b7-100b-423d-920f-14f3e33f5f60?source=cve · Note
• https://twitter.com/CVEnew/status/2027004221862650292 · Twitter Post
• https://t.me/CVEtracker/45816 · Telegram Post
• https://plugins.trac.wordpress.org/browser/tp2wp-importer/trunk/attachments/templates/page.php#L28 · Note