PatchSiren cyber security CVE debrief
CVE-2026-5293 olivesystem CVE debrief
A stored cross-site scripting (XSS) vulnerability in the WordPress plugin 診断ジェネレータ作成プラグイン (Diagnosis Generator) allows authenticated attackers with subscriber-level access or higher to inject arbitrary JavaScript into theme files. The vulnerability exists in versions up to and including 1.4.16. The themeFunc() function, hooked to admin_init, processes theme update requests without proper authorization checks, permitting low-privileged users to save malicious content. Additionally, the save() function uses stripslashes(), which removes WordPress's magic quotes protection, facilitating script injection. Injected scripts execute when any user accesses a page containing the diagnosis form shortcode.
- Vendor
- olivesystem
- Product
- 診断ジェネレータ作成プラグイン
- CVSS
- MEDIUM 6.4
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-20
- Original CVE updated
- 2026-05-20
- Advisory published
- 2026-05-20
- Advisory updated
- 2026-05-20
Who should care
WordPress site administrators using the Diagnosis Generator plugin; security teams monitoring for plugin-based XSS vectors; developers reviewing authorization patterns in admin_init hooks
Technical summary
The Diagnosis Generator plugin's themeFunc() function executes on admin_init without verifying user capabilities (such as manage_options or edit_themes), allowing any authenticated user to trigger theme updates. The save() function's use of stripslashes() on the 'js' parameter removes escaping that would otherwise mitigate XSS. Malicious JavaScript is written to theme files and rendered via the diagnosis form shortcode, executing in victims' browsers. The vulnerability requires network access, low privileges, no user interaction, and affects confidentiality and integrity with low impact.
Defensive priority
medium
Recommended defensive actions
- Update the 診断ジェネレータ作成プラグイン (Diagnosis Generator) plugin to a version newer than 1.4.16
- Review theme files for unauthorized JavaScript modifications if the plugin was active with untrusted subscriber accounts
- Implement least-privilege access controls and restrict subscriber capabilities where possible
- Monitor for unexpected admin_init hook executions by low-privileged users
- Consider Web Application Firewall rules to detect and block suspicious theme file modification requests
Evidence notes
Vulnerability disclosed by Wordfence. Source code analysis confirms missing capability checks in themeFunc() and use of stripslashes() in save() function. CVSS 3.1 vector: AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N.
Official resources
2026-05-20