GCVE - cpe:2.3:a:olivesystem:診断ジェネレータ作成プラグイン:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:olivesystem:診断ジェネレータ作成プラグイン:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Olivesystem (`5f75fb59-89c8-53ba-8638-34efa4180b24`)
Product	診断ジェネレータ作成プラグイン (`a1dfa235-6b6a-545a-827b-26f3f1dd80cc`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-5293`	vulnerable	2026-06-08 08:07:03.497969	診断ジェネレータ作成プラグイン <= 1.4.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'js' Parameter MEDIUM (6.4) The 診断ジェネレータ作成プラグイン (Diagnosis Generator) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'js' parameter in versions up to and including 1.4.16. This is due to missing authorization checks and insufficient input sanitization in the themeFunc() function. The function is hooked to 'admin_init' and processes theme update requests without verifying user capabilities, allowing any authenticated user (including subscribers) to save malicious JavaScript to theme files. Additionally, the save() function uses stripslashes() which removes WordPress's magic quotes protection. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in theme files that will execute whenever a user accesses a page containing the diagnosis form shortcode. Published: 2026-05-20T01:25:53.138Z Updated: 2026-05-20T13:03:00.373Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/c5293c0f-90b0-41df-a623-90297d998c41?source=cve https://plugins.trac.wordpress.org/browser/os-diagnosis-generator/trunk/diagnosisAdminClass.php#L409 https://plugins.trac.wordpress.org/browser/os-diagnosis-generator/tags/1.4.16/diagnosisAdminClass.php#L409 https://plugins.trac.wordpress.org/browser/os-diagnosis-generator/trunk/class/themeClass.php#L26 https://plugins.trac.wordpress.org/browser/os-diagnosis-generator/tags/1.4.16/class/themeClass.php#L26	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-30934`	vulnerable	2026-06-08 07:17:02.080842	WordPress 診断ジェネレータ作成プラグイン plugin <= 1.4.16 - Broken Access Control Vulnerability MEDIUM (5.3) Missing Authorization vulnerability in OLIVESYSTEM 診断ジェネレータ作成プラグイン os-diagnosis-generator allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects 診断ジェネレータ作成プラグイン: from n/a through <= 1.4.16. Published: 2025-06-06T12:54:17.586Z Updated: 2026-04-28T16:12:01.882Z Open on db.gcve.eu Reference links https://patchstack.com/database/Wordpress/Plugin/os-diagnosis-generator/vulnerability/wordpress-1-4-16-broken-access-control-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.