CVE-2026-5293: WordPress Diagnosis Generator XSS Flaw

CVE-2026-5293 Overview

The 診断ジェネレータ作成プラグイン (Diagnosis Generator) plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability affecting versions up to and including 1.4.16. The flaw resides in the themeFunc() function, which is hooked to admin_init but fails to verify user capabilities before processing theme update requests. Authenticated attackers with subscriber-level access can inject arbitrary JavaScript into theme files. The malicious script executes whenever any user loads a page containing the diagnosis form shortcode, enabling session theft, privilege escalation, and site defacement. The vulnerability is tracked as [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact

Subscriber-level users can store persistent JavaScript in theme files that executes against every visitor rendering the diagnosis form.

Affected Products

• WordPress 診断ジェネレータ作成プラグイン (Diagnosis Generator / os-diagnosis-generator) plugin, all versions through 1.4.16
• WordPress sites using the diagnosis form shortcode
• Any environment permitting subscriber-level user registration with the plugin installed

Discovery Timeline

• 2026-05-20 - CVE-2026-5293 published to NVD
• 2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-5293

Vulnerability Analysis

The vulnerability is a stored XSS issue rooted in two compounding defects within the plugin. First, the themeFunc() function registered against the admin_init hook processes theme update requests without invoking WordPress capability checks such as current_user_can(). Because admin_init fires for any authenticated user accessing /wp-admin/, including subscribers, low-privileged accounts can reach the handler. Second, the save() function applies stripslashes() to incoming data, which strips WordPress magic quotes protection and permits raw script payloads to reach the theme file write routine.

The written content is later included by the rendering path in user-viewFormPage.php when a visitor accesses any page containing the diagnosis form shortcode. The script executes in the browser of every visitor, including administrators. Because the scope of the CVSS metric is Changed, the injected script can act against resources beyond the plugin's own security boundary, such as the wider WordPress admin session.

Root Cause

The root cause is missing authorization combined with insufficient input sanitization. The themeFunc() handler omits capability verification, and save() actively removes escaping via stripslashes() before writing user-controlled data to a theme file consumed at render time.

Attack Vector

The attack is remote and requires only a subscriber account. The attacker submits a crafted request containing JavaScript in the js parameter to the admin endpoint serviced by themeFunc(). The payload is persisted into a theme file. Any subsequent visitor — authenticated or anonymous — loading a page containing the diagnosis form shortcode triggers execution of the stored script.

No verified public exploit code is available. Refer to the Wordfence Vulnerability Analysis and the vulnerable themeClass.php source for technical details on the affected code paths.

Detection Methods for CVE-2026-5293

Indicators of Compromise

• Unexpected <script> tags or JavaScript content inside theme files associated with the os-diagnosis-generator plugin
• POST requests to wp-admin/ endpoints containing a js parameter originating from subscriber-level accounts
• New or modified theme files with timestamps coinciding with low-privilege user logins
• Outbound browser requests from site visitors to unfamiliar domains after loading pages with the diagnosis form shortcode

Detection Strategies

• Perform integrity monitoring on plugin and theme directories under wp-content/ to detect unauthorized file writes
• Inspect WordPress access logs for admin-ajax.php or admin_init-triggered requests from subscriber accounts containing script-like payloads
• Scan rendered output of pages using the diagnosis form shortcode for injected <script> content not present in known-good baselines
• Review the wp_users table for recently registered subscriber accounts that subsequently issued POST requests to admin endpoints

Monitoring Recommendations

• Enable WordPress audit logging to capture all theme and plugin file modifications with associated user identity
• Alert on any non-administrator user successfully invoking theme update functionality
• Monitor for outbound HTTP requests from rendered WordPress pages to domains outside the established allowlist
• Track creation of new subscriber accounts followed by activity against /wp-admin/ endpoints within a short window

How to Mitigate CVE-2026-5293

Immediate Actions Required

• Deactivate the 診断ジェネレータ作成プラグイン (Diagnosis Generator) plugin until a patched version is installed
• Audit theme files for injected JavaScript and restore from a known-good backup if tampering is found
• Review and remove unrecognized subscriber-level accounts created on affected sites
• Force password resets for administrators who accessed the site while the plugin was active

Patch Information

At the time of publication, all versions up to and including 1.4.16 are affected. Site operators should monitor the WordPress plugin repository for a fixed release that adds capability checks to themeFunc() and removes the stripslashes() call in save() while properly sanitizing the js parameter.

Workarounds

• Disable open user registration or restrict the subscriber role from accessing /wp-admin/ using a security plugin or web server rules
• Remove pages containing the diagnosis form shortcode from public-facing sections of the site until patched
• Apply a Web Application Firewall (WAF) rule blocking POST requests to admin endpoints that contain <script or JavaScript event handlers in the js parameter
• Set theme directory permissions to read-only for the web server user where operationally feasible

# Configuration example: Apache rule restricting wp-admin access to administrators by IP
<Directory "/var/www/html/wp-admin">
    Require ip 203.0.113.0/24
</Directory>

# Example WAF rule pattern (ModSecurity) blocking script payloads in 'js' parameter
SecRule ARGS:js "@rx (?i)(<script|onerror=|onload=|javascript:)" \
    "id:1026529301,phase:2,deny,status:403,msg:'CVE-2026-5293 XSS attempt blocked'"