{"items":[{"id":"NVI-00002350","kind":"vulnerability","title":"The Query Monitor plugin for WordPress has Reflected Cross-Site Scripting via Request URI","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-2xr4-chcf-vmvf","CVE-2026-4267"],"plain_summary":"OSV carries this publisher advisory for johnbillion/query-monitor. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 3.20.4 for johnbillion/query-monitor. Confirm the publisher’s latest guidance.","source_ids":["sr-14b67ebaed921c88b4829e8048836045"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-59c8931e38ddf52ecf0fae8b650130ff"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-24T20:10:00.147Z","value":"7.2 HIGH (3.1)","meaning":"security@wordfence.com severity; no combined Null risk score.","source_id":"sr-c4cb45550bbed873b84d5a5de0511b96"},{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.307%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.23593. Missing scores are unknown.","source_id":"sr-59c8931e38ddf52ecf0fae8b650130ff"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-14b67ebaed921c88b4829e8048836045","url":"https://github.com/advisories/GHSA-2xr4-chcf-vmvf","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-2xr4-chcf-vmvf","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:49.647Z"},{"id":"sr-c4cb45550bbed873b84d5a5de0511b96","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4267","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-4267","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-01T07:24:02.489Z"},{"id":"sr-59c8931e38ddf52ecf0fae8b650130ff","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-4267","publisher":"FIRST EPSS","observed_at":"2026-10-31T22:06:15.382Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-14b67ebaed921c88b4829e8048836045"],"technology":"johnbillion/query-monitor","known_exclusions":[],"conditions_summary":"### Impact\n\nThe Query Monitor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['REQUEST_URI']` parameter in all versions up to, and including, 3.20.3 due to insufficient output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an Administrator-level user into performing an action such as clicking on a link.\n\nOn admin requests, the plugin reads user controlled data from `$_SERVER['REQUEST_URI']` and stores it in the request field, then renders `request`, `matched_query`, and `query_string` through `format_url()`. If the attacker supplied string does not contain `&`, `format_url()` returns it without HTML escaping, which allows injected HTML or JavaScript from the request target to be inserted directly into the page inside a `` element and executed in the victim's browser.\n\n### Patches\n\nThis issue has been patched in Query Monitor 3.20.4.\n\n### Credits\n\nMany thanks to Dmitrii Ignatyev at CleanTalk for responsibly disclosing this vulnerability.\n\n### How can I report a security bug?\n\nYou can submit a private security vulnerability report to Query ","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 3.20.4"]}],"null_published_at":"2026-11-07T22:29:23.398Z","source_updated_at":"2026-03-19T19:56:20.713Z","source_disclosed_at":"2026-03-19T19:37:04.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T21:41:49.647Z"},{"id":"NVI-00002350","kind":"vulnerability","title":"The Query Monitor plugin for WordPress has Reflected Cross-Site Scripting via Request URI","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-2xr4-chcf-vmvf","CVE-2026-4267"],"plain_summary":"OSV carries this publisher advisory for johnbillion/query-monitor. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 3.20.4 for johnbillion/query-monitor. Confirm the publisher’s latest guidance.","source_ids":["sr-14b67ebaed921c88b4829e8048836045"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-59c8931e38ddf52ecf0fae8b650130ff"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.307%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.23593. Missing scores are unknown.","source_id":"sr-59c8931e38ddf52ecf0fae8b650130ff"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-14b67ebaed921c88b4829e8048836045","url":"https://github.com/advisories/GHSA-2xr4-chcf-vmvf","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-2xr4-chcf-vmvf","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:49.647Z"},{"id":"sr-59c8931e38ddf52ecf0fae8b650130ff","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-4267","publisher":"FIRST EPSS","observed_at":"2026-10-31T22:06:15.382Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-14b67ebaed921c88b4829e8048836045"],"technology":"johnbillion/query-monitor","known_exclusions":[],"conditions_summary":"### Impact\n\nThe Query Monitor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['REQUEST_URI']` parameter in all versions up to, and including, 3.20.3 due to insufficient output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an Administrator-level user into performing an action such as clicking on a link.\n\nOn admin requests, the plugin reads user controlled data from `$_SERVER['REQUEST_URI']` and stores it in the request field, then renders `request`, `matched_query`, and `query_string` through `format_url()`. If the attacker supplied string does not contain `&`, `format_url()` returns it without HTML escaping, which allows injected HTML or JavaScript from the request target to be inserted directly into the page inside a `` element and executed in the victim's browser.\n\n### Patches\n\nThis issue has been patched in Query Monitor 3.20.4.\n\n### Credits\n\nMany thanks to Dmitrii Ignatyev at CleanTalk for responsibly disclosing this vulnerability.\n\n### How can I report a security bug?\n\nYou can submit a private security vulnerability report to Query ","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 3.20.4"]}],"null_published_at":"2026-11-01T01:45:38.520Z","source_updated_at":"2026-03-19T19:56:20.713Z","source_disclosed_at":"2026-03-19T19:37:04.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:41:49.647Z"},{"id":"NVI-00002350","kind":"vulnerability","title":"The Query Monitor plugin for WordPress has Reflected Cross-Site Scripting via Request URI","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-2xr4-chcf-vmvf","CVE-2026-4267"],"plain_summary":"OSV carries this publisher advisory for johnbillion/query-monitor. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 3.20.4 for johnbillion/query-monitor. Confirm the publisher’s latest guidance.","source_ids":["sr-14b67ebaed921c88b4829e8048836045"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-14b67ebaed921c88b4829e8048836045","url":"https://github.com/advisories/GHSA-2xr4-chcf-vmvf","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-2xr4-chcf-vmvf","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:49.647Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-14b67ebaed921c88b4829e8048836045"],"technology":"johnbillion/query-monitor","known_exclusions":[],"conditions_summary":"### Impact\n\nThe Query Monitor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['REQUEST_URI']` parameter in all versions up to, and including, 3.20.3 due to insufficient output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an Administrator-level user into performing an action such as clicking on a link.\n\nOn admin requests, the plugin reads user controlled data from `$_SERVER['REQUEST_URI']` and stores it in the request field, then renders `request`, `matched_query`, and `query_string` through `format_url()`. If the attacker supplied string does not contain `&`, `format_url()` returns it without HTML escaping, which allows injected HTML or JavaScript from the request target to be inserted directly into the page inside a `` element and executed in the victim's browser.\n\n### Patches\n\nThis issue has been patched in Query Monitor 3.20.4.\n\n### Credits\n\nMany thanks to Dmitrii Ignatyev at CleanTalk for responsibly disclosing this vulnerability.\n\n### How can I report a security bug?\n\nYou can submit a private security vulnerability report to Query ","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 3.20.4"]}],"null_published_at":"2026-10-31T22:00:33.877Z","source_updated_at":"2026-03-19T19:56:20.713Z","source_disclosed_at":"2026-03-19T19:37:04.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:41:49.647Z"}],"next_cursor":null,"snapshot_revision":"42594"}