CVE-2026-6404
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The Anomify AI plugin for WordPress up to 0.3.6 is vulnerable to Stored XSS via the 'anomify_api_key' parameter. sanitize_text_field() strips HTML but does not encode double quotes, and the value is echoed into an HTML attribute without esc_attr().
Risk Assessment
Administrators can inject malicious scripts that execute when visiting the plugin settings page, potentially leading to session hijacking or data theft.
Recommendation
Update the Anomify AI plugin to the latest version. Restrict admin panel access to trusted users.
Original NVD description (English source)
The Anomify AI – Anomaly Detection and Alerting plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'anomify_api_key' parameter in versions up to and including 0.3.6. This is due to insufficient input sanitization and missing output escaping: the plugin applies sanitize_text_field() to the Metric Data Key input before saving it via update_option(), but sanitize_text_field() strips HTML tags without encoding double-quote characters, and the value is then echoed directly into an HTML attribute context (value="...") without esc_attr(). This makes it possible for authenticated attackers with administrator-level access to inject arbitrary web scripts that execute whenever a user visits the plugin's settings page.