診断ジェネレータ作成プラグイン <= 1.4.16 — Authenticated (Subscriber+) Stored Cross-Site Scripting via 'js' Parameter

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under 診断ジェネレータ作成プラグイン.
• No admin access? Run a passive check of your site. It reads public files only.

What to do

1. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch 診断ジェネレータ作成プラグイン to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to Nabil Irawan.

The 診断ジェネレータ作成プラグイン (Diagnosis Generator) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'js' parameter in versions up to and including 1.4.16. This is due to missing authorization checks and insufficient input sanitization in the themeFunc() function. The function is hooked to 'admin_init' and processes theme update requests without verifying user capabilities, allowing any authenticated user (including subscribers) to save malicious JavaScript to theme files. Additionally, the save() function uses stripslashes() which removes WordPress's magic quotes protection. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in theme files that will execute whenever a user accesses a page containing the diagnosis form shortcode.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. May 19, 2026

   CVE published

   Severity medium, CVSS 6.4

2. Nov 13, 2026

   Record last updated