Stored Cross-Site Scripting Vulnerability in Custom New User Notification Plugin for WordPress

CVE-2026-3551

What is CVE-2026-3551?

The Custom New User Notification plugin for WordPress suffers from a stored cross-site scripting vulnerability stemming from inadequate input sanitization and output escaping in its admin settings. This flaw allows authenticated users with Administrator-level access to inject malicious scripts into the plugin’s settings page. Specifically, critical fields like 'User Mail Subject', 'User From Name', and others are registered without proper sanitization callbacks. As a result, when an admin accesses the settings page, the injected scripts can execute, potentially leading to unauthorized actions in multisite installations where sub-site administrators can target super admins.

References