CVE-2026-6405 — Cross-Site Scripting (XSS)

title: WordPress Anomify AI Plugin Stored XSS via CSRF - Free Tier
id: scw-2026-05-20-ai-1
status: experimental
level: high
description: |
  Detects a POST request to the Anomify AI settings page in WordPress that includes a potential XSS payload within the URI query. This targets the specific vulnerability where the API key field is not properly escaped, allowing an attacker to inject scripts that execute when an administrator views the settings page. The payload '" onmouseover=alert(1)' is a common indicator for XSS attempts.
author: SCW Feed Engine (AI-generated)
date: 2026-05-20
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-6405/
tags:
  - attack.initial_access
  - attack.t1189
logsource:
    category: webserver
detection:
  selection:
      cs-method:
          - 'POST'
      cs-uri:
          - '/wp-admin/admin.php'
      cs-uri-query|contains:
          - 'page=anomify_ai_settings'
      referer|contains:
          - '/wp-admin/admin.php?page=anomify_ai_settings'
  selection_payload:
      uri|contains:
          - '" onmouseover=alert(1)'
      condition: selection AND selection_payload
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse