Anomify AI <= 0.3.6 — Authenticated (Administrator+) Stored Cross-Site Scripting via 'anomify_api_key' Parameter

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under Anomify AI – Anomaly Detection and Alerting.
• No admin access? Run a passive check of your site. It reads public files only.

What to do

1. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch Anomify AI – Anomaly Detection and Alerting to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to Muhammad Nur Ibnu Hubab.

The Anomify AI – Anomaly Detection and Alerting plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'anomify_api_key' parameter in versions up to and including 0.3.6. This is due to insufficient input sanitization and missing output escaping: the plugin applies sanitize_text_field() to the Metric Data Key input before saving it via update_option(), but sanitize_text_field() strips HTML tags without encoding double-quote characters, and the value is then echoed directly into an HTML attribute context (value="...") without esc_attr(). This makes it possible for authenticated attackers with administrator-level access to inject arbitrary web scripts that execute whenever a user visits the plugin's settings page.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. May 19, 2026

   CVE published

   Severity medium, CVSS 4.4

2. Nov 13, 2026

   Record last updated