[nareshsnaidu]

…fected by CVE-2026-39738, Enable Media Replace Affected by CVE-2026-73186, Solid Testimonials Affected by CVE-2026-78527

[jgstew]

Thanks for these! I tested all 6 signatures with the real BigFix Inventory CIT scanner (11.0.44.0, wscanfs + wscansw -i) on Linux (Debian 12 amd64 container) and on Windows. Fixtures were the real plugin zips from downloads.wordpress.org, planted in wp-content/plugins/ layouts (25 versions across both sides of each threshold), plus CRLF and no-TAB header variants.

Summary: the version thresholds are right and current releases are detected correctly, but the version extraction silently misses some affected installs. A small, tested fix is below.

What passes

• Outer signature.xsd, CDATA well-formedness, and the scanner's own XSS schema: all 6 pass.
• Thresholds match the published ranges: EMR ≤ 4.2.2 (4.2.3 excluded), FunnelKit ≤ 3.8.6.1 (3.8.6.2 and 3.9.0.1 excluded), Solid Testimonials ≤ 3.3.10 (no patched release yet, so all versions are flagged).

Issues

1. Enable Media Replace ≤ 3.4.0 is never flagged. Those releases use a plain Version: 3.3.0 header, without the * prefix. startString="
 * Version: " isn't found, so the crop returns the first line of the file: the ALL file reports DETAILED_VER=<?php and the AFFECTED file drops the instance. Confirmed with real 2.9.6, 3.3.0 and 3.4.0; 3.5.0+ work.

2. CRLF line endings drop EMR and FunnelKit from the AFFECTED files. A main plugin file with CRLF endings (e.g. after git autocrlf or an ASCII-mode FTP upload) yields 4.2.2\r, Compare fails ("Scalar expression [Compare] failed") and the instance is skipped. Same on Linux and Windows. Solid Testimonials already handles CRLF.

3. Solid Testimonials depends on a TAB. If the header is ever reformatted with spaces only, the result is " 3.3.7", which fails Compare.

4. ALL files report unparsed versions as installed. There's no skip on an empty or unparsed DETAILED_VER, which is how issue 1 shows up as an install with version <?php.

Suggested fix

Replace the DETAILED_VER variable in all 6 files with the block below. In the Solid Testimonials files, it also replaces Version_Line. It takes the first Version: line, removes a trailing CR, and keeps the text after the last space and then after the last TAB:

<Variable export="false" name="version_line"><StringCrop endString="&#10;" inputString="$(file_read)" seekFrom="left" startString="Version:"/></Variable><Variable export="false" name="version_no_cr"><StringCrop endString="&#13;" inputString="$(version_line)" seekFrom="left" startString=""/></Variable><Variable export="false" name="version_no_space"><StringCrop endString="" inputString="$(version_no_cr)" seekFrom="right" startString=" "/></Variable><Variable export="true" name="DETAILED_VER"><StringCrop endString="" inputString="$(version_no_space)" seekFrom="right" startString="&#9;"/></Variable><Condition withVariable="DETAILED_VER"><Action do="SKIP" onValue=""/></Condition>

With this change, every fixture returned the correct version with no scanner warnings, on both Linux and Windows. That covers EMR 2.9.6–4.2.3, FunnelKit 1.0.0–3.9.0.1, Solid Testimonials 1.0.0–3.3.10, and the CRLF and no-TAB variants. The fixed releases are still excluded by the AFFECTED files.

Fixture	Current PR (AFFECTED)	With fix
EMR 4.2.2 / 4.2.3	4.2.2 true / excluded	same
EMR 2.9.6, 3.3.0, 3.4.0	not reported (ALL: <?php)	true
EMR 4.2.2 CRLF	not reported (ALL: 4.2.2&#13;)	true
FunnelKit 3.8.6.1 / 3.8.6.2 / 3.9.0.1	true / excluded / excluded	same
FunnelKit 3.8.6.1 CRLF	not reported (ALL: 3.8.6.1&#13;)	true
Solid Testimonials 3.3.7, 3.3.10, CRLF	true	same
Solid Testimonials, no TAB	not reported (ALL: 3.3.7)	true

Nits

• INSTALL_PATH is the full .php path (appendFileName="true"). Most signatures report the folder.
• The uniqueIds are version-1 UUIDs, which embed the generating machine's MAC address. Random uuid4 IDs are preferable.
• None of the 6 files ends with a newline, so the end-of-file-fixer pre-commit hook will flag them.
• The PR title is truncated.
• Once Solid Testimonials ships a fix, its AFFECTED threshold will need an update.

Not covered by my testing: a full BigFix Inventory deployment (I used standalone CIT with a scan config that includes these file names), and the Pro/premium variants of these plugins. macOS endpoints can't run extended signatures at all with the current scanner.

[nareshsnaidu]

Addressed the changes suggested in the above comment.

[jgstew]

issues addressed, ready to merge.