{"id":"CVE-2026-9271","aliases":[],"cve":{"records":[{"id":"CVE-2026-9271","source":"WPScan","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-05-22T10:27:21.437Z","published":"2026-06-12T06:00:02.052Z","modified":"2026-11-13T09:15:31.473Z"}],"publishers":[{"name":"WPScan","role":"CNA","organizationId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","modified":"2026-11-13T09:15:31.473Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-06-12T14:49:15.343Z"}],"references":[{"url":"https://wpscan.com/vulnerability/b5d549b7-17c8-417d-a86a-a7ae356a6eab/","tags":["exploit","vdb-entry","technical-description"],"source":"WPScan"}],"weaknesses":[],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-06-12T14:49:07.767988Z","decisions":[{"name":"Exploitation","value":"poc"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"KeepInMind - Dashboard Notes <= 0.8.5 - Contributor+ Stored XSS","titleSource":"WPScan","descriptionSource":"WPScan","description":"The KeepInMind Dashboard Notes WordPress plugin through 0.8.5 does not properly sanitize note content submitted through its REST API, allowing users with a low-privileged role (such as Contributor, where an administrator has enabled it) to store CSS that redresses the administrator dashboard for credential phishing and denial of service; the fix released in 0.8.4.2 addressed only the editor interface and left the REST write path exploitable.","score":6.8,"severity":"medium","published":"2026-06-12T06:00:02.052Z","modified":"2026-11-13T09:15:31.473Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Unknown","name":"KeepInMind Dashboard Notes","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"0.8.5","versionType":"semver"}],"defaultStatus":"unknown","cpes":[],"source":"WPScan","url":"https://www.cve.org/CVERecord?id=CVE-2026-9271"}],"remediation":[],"references":["https://wpscan.com/vulnerability/b5d549b7-17c8-417d-a86a-a7ae356a6eab/"],"sources":[{"name":"CVE","id":"CVE-2026-9271","modified":"2026-11-13T09:15:31.473Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-9271"}],"assessments":[{"source":"WPScan","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","score":6.8},{"source":"CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L","score":5.9}],"sourceAffected":[],"observedAt":"2026-11-13T12:42:29.746Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T23:35:33.875Z"},"coverage":[{"source":"NVD","status":"refresh-failed","attemptedAt":"2026-11-14T09:15:34.481Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-14T09:10:33.338Z","attemptedAt":"2026-11-14T09:10:33.338Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-14T09:00:31.031Z","attemptedAt":"2026-11-14T09:00:31.031Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-14T09:00:30.986Z","attemptedAt":"2026-11-14T09:00:30.986Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-9271","url":"https://www.first.org/epss/","probability":0.00868,"percentile":0.59283,"date":"2026-11-13","checkedAt":"2026-11-14T09:00:30.986Z"},{"source":"ENISA EUVD","id":"EUVD-2026-36388","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-36388","modified":"Nov 13, 2026, 9:15:31 AM","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","checkedAt":"2026-11-14T09:00:31.031Z"},{"source":"GitHub Advisory Database","id":"GHSA-8fxh-qpf8-gq8x","url":"https://github.com/advisories/GHSA-8fxh-qpf8-gq8x","modified":"2026-06-12T18:32:55Z","score":5.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L","checkedAt":"2026-11-14T09:10:33.338Z"},{"source":"Exploit-DB","id":"52614","url":"https://www.exploit-db.com/exploits/52614","checkedAt":"2026-11-14T00:00:38.122Z"}],"aiSummary":{"text":"The KeepInMind Dashboard Notes WordPress plugin through 0.8.5 has a stored XSS vulnerability, allowing low-privileged users to store malicious CSS via the REST API. This can lead to credential phishing and denial of service. The fix in 0.8.4.2 only addressed the editor interface.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-13T14:06:06.106Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-9271"}]}}