PT-2026-33262 · WordPress · Custom New User Notification

Published 2026-04-16 · Updated 2026-04-24 · CVE-2026-3551

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Custom New User Notification plugin for WordPress versions prior to 1.2.1

Description Stored Cross-Site Scripting is possible via the admin settings due to insufficient input sanitization and output escaping on multiple settings fields. The settings are registered via the register setting() function without sanitize callbacks, and values retrieved via get option() are echoed directly into HTML input value attributes without esc attr(). This allows authenticated attackers with Administrator-level access or higher to inject arbitrary web scripts into the plugin settings page. In multi-site installations, this could be used by subsite administrators to target super administrators. The affected fields include 'User Mail Subject', 'User From Name', 'User From Email', 'Admin Mail Subject', 'Admin From Name', and 'Admin From Email'.

Recommendations Update the plugin to a version later than 1.2.0.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-3551

Affected Products

Custom New User Notification

References · 20

• https://nvd.nist.gov/vuln/detail/CVE-2026-3551 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/7a14d35d-144c-4ddd-b288-5e0e006fb165?source=cve · Note
• https://plugins.trac.wordpress.org/browser/custom-new-user-notification/tags/1.2.0/admin/includes.php#L132 · Note
• https://plugins.trac.wordpress.org/browser/custom-new-user-notification/trunk/custom-new-user-notification.php#L63 · Note
• https://plugins.trac.wordpress.org/browser/custom-new-user-notification/trunk/admin/includes.php#L132 · Note
• https://reddit.com/r/StopBadBots/comments/1su8tkw/unpatched_threat_why_you_must_remove_these_29 · Reddit Post
• https://plugins.trac.wordpress.org/browser/custom-new-user-notification/tags/1.2.0/admin/includes.php#L90 · Note
• https://plugins.trac.wordpress.org/browser/custom-new-user-notification/tags/1.2.0/custom-new-user-notification.php#L63 · Note
• https://plugins.trac.wordpress.org/browser/custom-new-user-notification/tags/1.2.0/admin/includes.php#L97 · Note
• https://plugins.trac.wordpress.org/browser/custom-new-user-notification/tags/1.2.0/admin/includes.php#L84 · Note
• https://plugins.trac.wordpress.org/browser/custom-new-user-notification/trunk/admin/includes.php#L97 · Note
• https://plugins.trac.wordpress.org/browser/custom-new-user-notification/tags/1.2.0/admin/includes.php#L46 · Note
• https://plugins.trac.wordpress.org/browser/custom-new-user-notification/trunk/admin/includes.php#L59 · Note
• https://plugins.trac.wordpress.org/browser/custom-new-user-notification/trunk/admin/includes.php#L90 · Note
• https://plugins.trac.wordpress.org/browser/custom-new-user-notification/tags/1.2.0/admin/includes.php#L52 · Note