Junglewise Threat Intelligence

CVE-2026-8905: Osiris Signature Banner CSRF and Script Injection

CVE-2026-8905 · Severity: medium · CVSS 6.1 · Published 2026-06-24

Executive brief

The Osiris Signature Banner plugin for WordPress, which allows users to add custom banners to their site, contains a security flaw that could allow an attacker to change plugin settings. By tricking a site administrator into clicking a malicious link, an attacker can remotely modify configurations or inject harmful scripts into the website. This could lead to unauthorized changes to the site's appearance or the redirection of visitors to malicious websites.

Technical details

The Osiris Signature Banner plugin for WordPress (versions <= 0.5) is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on its settings-handling functions. An unauthenticated attacker can exploit this by crafting a malicious request and using social engineering to trick a logged-in administrator into executing it (e.g., via a malicious link). Successful exploitation allows the attacker to modify plugin settings and perform Stored Cross-Site Scripting (XSS) by injecting malicious scripts into the banner fields, which would then execute in the context of other users' browsers.

Affected products

  • osiris8 Osiris Signature Banner up to, and including, 0.5

Timeline

  • 2026-06-24: disclosed
  • 2026-06-24: advisory

References