CVE-2026-113409

Full vulnerability record from the local CVENow database.

Description

The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting. A threat actor able to modify the plugin's configuration could execute arbitrary JavaScript in an administrator's session when they visited the impacted page.

Severity

MEDIUM

CVSS score

4.8 (v3.1)

Vulnerability status

Deferred

Source identifier

61adb53e-e4b3-47f7-8a93-4717c9e77dc6

Published

2026-10-29 02:16:50.070000

Last modified

2026-10-29 15:12:05.973000

View original CVE JSON

{
  "id": "CVE-2026-113409",
  "sourceIdentifier": "61adb53e-e4b3-47f7-8a93-4717c9e77dc6",
  "published": "2026-10-29T02:16:50.070",
  "lastModified": "2026-10-29T15:12:05.973",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting. A threat actor able to modify the plugin's configuration could execute arbitrary JavaScript in an administrator's session when they visited the impacted page."
    }
  ],
  "affected": [
    {
      "source": "61adb53e-e4b3-47f7-8a93-4717c9e77dc6",
      "affectedData": [
        {
          "vendor": "canva",
          "product": "ortto",
          "defaultStatus": "unaffected",
          "platforms": [
            "WordPress"
          ],
          "versions": [
            {
              "version": "0",
              "lessThan": "1.0.25",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "61adb53e-e4b3-47f7-8a93-4717c9e77dc6",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 4.8,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.7,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-29T01:49:28.666693Z",
          "id": "CVE-2026-113409",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "61adb53e-e4b3-47f7-8a93-4717c9e77dc6",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://trust.canva.com?tcuUid=acddc58b-886d-487c-b2d4-837fde87ddc8",
      "source": "61adb53e-e4b3-47f7-8a93-4717c9e77dc6"
    }
  ]
}