CVE-2026-19797: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in gm_alex User Access Manager
Affects gm_alex User Access ManagerSource GCVE Database
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 11% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| gm_alex User Access Manager | Affected
| Fixed in– |
AI-suggested
Users should monitor the vendor's advisory for updates. Until a fix is available, consider implementing web application firewall (WAF) rules to detect and block malicious input targeting the 'tab_group_section' parameter. Educate users to avoid clicking suspicious links.
Description
The User Access Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab_group_section' parameter in all versions up to, and including, 2.3.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Impact
Successful exploitation can lead to limited confidentiality and integrity impacts by executing arbitrary scripts in the context of the affected site. This could allow attackers to perform actions such as session hijacking or defacement within the scope of the user's browser session. There is no impact on availability. The vulnerability requires user interaction and no privileges or authentication are needed to exploit.
Summary
CVE-2026-19797 is a reflected cross-site scripting vulnerability in the User Access Manager WordPress plugin (gm_alex) affecting versions up to 2.3.18. The issue arises from improper neutralization of input in the 'tab_group_section' parameter, leading to insufficient sanitization and output escaping. An unauthenticated attacker can exploit this by tricking a user into clicking a malicious link, causing arbitrary script execution in the user's browser context.
Weaknesses
References
- nvd.nist.gov/vuln/detail/CVE-2026-19797 (opens in a new tab)
- plugins.trac.wordpress.org/browser/user-access-manager/tags/2.3.18/src/Controller/Backend/ControllerTabNavigationTrait.php (opens in a new tab)
- plugins.trac.wordpress.org/browser/user-access-manager/tags/2.3.18/src/Controller/BaseControllerTrait.php (opens in a new tab)
- plugins.trac.wordpress.org/browser/user-access-manager/tags/2.3.18/src/Controller/BaseControllerTrait.php (opens in a new tab)
- plugins.trac.wordpress.org/browser/user-access-manager/tags/2.3.18/src/View/AdminSettings.php (opens in a new tab)
- plugins.trac.wordpress.org/changeset?reponame=&old=3680890%40user-access-manager&new=3680890%40user-access-manager (opens in a new tab)
- wordfence.com/threat-intel/vulnerabilities/id/a7e1fd8f-548e-4fb2-9ee4-b24c412aaa8e?source=cve (opens in a new tab)