CVE-2026-119490
📛 CVE Title
WordPress Better Notifications for WP plugin <= 1.10.1 - Content Injection vulnerability
Description
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Made with Fuel Ltd. Better Notifications for WP bnfw allows Code Injection.This issue affects Better Notifications for WP: from n/a through 1.10.1.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- Patchstack
- CVSS severity
- MEDIUM
- CVSS score
- 5.3 / 10
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N- Effective score
- 5.3 / 10 MEDIUM source: CNA overview
- CWE(s)
-
CWE-80 - Reserved
- 2026-10-30
- Published
- 2026-11-07 10:13 UTC
- Last updated
- 2026-11-07 10:13 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/119xxx/CVE-2026-119490.json
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-11-07 11:16:58 UTC
- NVD last modified
- 2026-11-07 11:16:58 UTC
- NVD CVSS v3.1
- 5.3 / 10 MEDIUM source: audit@patchstack.com
- NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N- Exploitability subscore
- 3.9 / 10
- Impact subscore
- 1.4 / 10
NVD / KEV / EPSS data refreshed 2026-11-08 10:04 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-119101
EUVD enrichment is queued; refresh the page in a few seconds.
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Made with Fuel Ltd. | Better Notifications for WP |
0 (affected)
|
— |
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
NVD-tagged references (1)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
Remediations (10)
-
web:cyberexperts.com
Citrix NetScaler CVE - 2026 -19490 (CVSS 9.3) is an unauth Gateway/AAA bypass now on CISA KEV. Upgrade fixed builds, confirm gateway scope, hunt sessions.
2026-11-08 11:42 UTC -
web:cyberupdates365.com
Track critical CVE vulnerabilities 2026 with verified enterprise patch guides. Fix zero-days across VMware, WordPress, Windows, and cloud infrastructure.
2026-11-08 11:42 UTC -
web:docs.netscaler.com
Remediate CVE - 2026 -19490 For CVE - 2026 -19490 impacted NetScaler instances, the remediation is a single-step process and you need to upgrade the vulnerable NetScaler instances to a release and build that has the fix . In the GUI, under CVE Detection > Impacted Instances, select the instances and click Proceed to upgrade workflow.
2026-11-08 11:42 UTC -
web:news.shield53.com
Active exploitation of Citrix NetScaler CVE - 2026 -19490 begins weeks after patch . Expert analysis on impact, affected configs, and urgent defender actions.
2026-11-08 11:42 UTC -
web:support.sap.com
On 13 th of October 2026 , SAP security patch day saw the release of 16 new security notes and 4 GitHub security advisories. There are 2 updates to previously released security notes.
2026-11-08 11:42 UTC -
web:support.servicenow.com
What you need to know: On September 24, 2026 , ServiceNow issued CVE - 2026 -86857, CVE - 2026 -86858, CVE - 2026 -13016, CVE - 2026 -86859, and CVE - 2026 -86860. Each of these security issues was identified through internal security testing, customer security assessments, or reports submitted through ServiceNow's responsible disclosure and bug bounty programs and was remediated independently. For security ...
2026-11-08 11:42 UTC -
web:tech-insider.org
CVE - 2026 -19490 lets attackers bypass NetScaler logins with no password. CISA added it to KEV Sept. 9 as Palo Alto, Check Point patch matching flaws.
2026-11-08 11:42 UTC -
web:www.decryptiondigest.com
The only complete remediation for CVE - 2026 -19490 is upgrading to the patched build. No configuration-only workaround eliminates the authentication bypass without the software fix . Citrix explicitly states no mitigation options exist for CVE - 2026 -19490 other than upgrading to the fixed versions documented in CTX696939.
2026-11-08 11:42 UTC -
web:www.esecurityplanet.com
CISA confirms exploitation of a WordPress Core upgrade flaw. Learn which versions contain fixes and what administrators should check for signs of compromise.
2026-11-08 11:42 UTC -
web:www.rapid7.com
CVE-2026-119490 : Made with Fuel Ltd. Better Notifications for WP: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Made with Fuel Ltd. View severity, references, and remediation details from Rapid7.
2026-11-08 11:42 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-119490.json.
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "bnfw",
"product": "Better Notifications for WP",
"vendor": "Made with Fuel Ltd.",
"versions": [
{
"changes": [
{
"at": "1.10.2",
"status": "unaffected"
}
],
"lessThanOrEqual": "1.10.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "mroccon | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-11-07T10:13:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Made with Fuel Ltd. Better Notifications for WP bnfw allows Code Injection.<p>This issue affects Better Notifications for WP: from n/a through 1.10.1.</p>"
}
],
"value": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Made with Fuel Ltd. Better Notifications for WP bnfw allows Code Injection.This issue affects Better Notifications for WP: from n/a through 1.10.1."
}
],
"impacts": [
{
"capecId": "CAPEC-242",
"descriptions": [
{
"lang": "en",
"value": "Code Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T10:13:30.707Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/bnfw/vulnerability/wordpress-better-notifications-for-wp-plugin-1-10-1-content-injection-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Better Notifications for WP plugin to the latest available version (at least 1.10.2)."
}
],
"value": "Update the WordPress Better Notifications for WP plugin to the latest available version (at least 1.10.2)."
}
],
"tags": [
"x_open-source"
],
"title": "WordPress Better Notifications for WP plugin <= 1.10.1 - Content Injection vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-119490",
"datePublished": "2026-11-07T10:13:30.275Z",
"dateReserved": "2026-10-30T09:20:18.655Z",
"dateUpdated": "2026-11-07T10:13:30.707Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}