Junglewise Threat Intelligence

CVE-2026-6404: Anomify AI WordPress plugin stored XSS in anomify_api_key

CVE-2026-6404 · Severity: medium · CVSS 4.4 · Published 2026-05-20

Executive brief

The Anomify AI plugin for WordPress, which provides anomaly detection and alerting services, contains a security flaw that allows administrators to inject malicious scripts into the plugin settings. If exploited, these scripts could execute in the browser of any user visiting the settings page, potentially leading to unauthorized actions or data theft. This risk is primarily relevant in environments where multiple administrators are present or where an administrator account has been compromised.

Technical details

The Anomify AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to improper input sanitization and output escaping of the 'anomify_api_key' parameter. While the plugin uses sanitize_text_field() before saving the value via update_option(), this function does not encode double-quote characters. Furthermore, the stored value is later echoed directly into an HTML attribute context (value="...") without using esc_attr(). An authenticated attacker with administrator-level privileges can exploit this to inject arbitrary web scripts. These scripts will execute whenever a user accesses the plugin's settings page.

Affected products

  • Anomify AI Anomify AI – Anomaly Detection and Alerting up to and including 0.3.6

Timeline

  • 2026-05-20: advisory: NVD publication date

References