Junglewise Threat Intelligence

CVE-2026-5293: Diagnosis Generator WordPress plugin stored XSS in themeFunc

CVE-2026-5293 · Severity: medium · CVSS 6.4 · Published 2026-05-20

Vendors: Unknown.

Executive brief

The Diagnosis Generator plugin for WordPress, which allows site owners to create interactive diagnostic forms, contains a security flaw that allows low-level users to inject malicious scripts into the website. An attacker with a basic account, such as a subscriber, can modify theme files to include harmful code that executes whenever other visitors view a page containing a diagnostic form. This could lead to unauthorized actions being performed in the context of other users' sessions or the theft of sensitive information.

Technical details

The Diagnosis Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to missing authorization checks and insufficient input sanitization in the themeFunc() function. This function is hooked to 'admin_init' and processes theme update requests without verifying user capabilities or using nonces. Furthermore, the save() function utilizes stripslashes(), which bypasses WordPress's built-in magic quotes protection. These flaws allow an authenticated attacker with subscriber-level permissions or higher to inject arbitrary JavaScript into theme files via the 'js' parameter. The malicious script is then executed in the browser of any user who visits a page where the diagnosis form shortcode is active.

Affected products

  • Unknown Diagnosis Generator (診断ジェネレータ作成プラグイン) Up to and including 1.4.16

Timeline

  • 2026-05-20: advisory: NVD publication date

References