WP Associate Post R2 CVE-2026-105870

Exploitation requires the attacker to lure an authenticated or browsing user into clicking a specially crafted URL that injects script into a page generated by the WP Associate Post R2 plugin (reflected XSS, so no persistent server state is needed). Limiting factors: mandatory user interaction (UI:R) means the attack fails without victim action; impact is confined to the victim's browser session and privileges; and the site must be running WP Associate Post R2 version 5.0.1 or earlier. No attacker authentication is required (PR:N), but the value of the attack scales with the privilege level of the victim who clicks.

This is a moderate-severity (CVSS 7.1) reflected cross-site scripting flaw whose real-world priority is bounded by its exploitation requirements rather than elevated by active-threat signals. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) shows network reach and no attacker privileges, but the mandatory user interaction (UI:R) means a victim must click a crafted link, which lowers practical exploitability versus a no-interaction flaw. No EPSS score, KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or automated weaponization - this is not confirmed to be in CISA KEV and no public exploit was identified at time of analysis. The scope change (S:C) and low C/I/A impacts are consistent with reflected XSS executing in the victim's browser session rather than compromising the server. Net: this is a real but lower-tier priority - a routine WordPress plugin XSS that should be patched in normal maintenance cycles rather than treated as an emergency, absent any exploitation intelligence. Note the A:L (availability) impact assigned in the input vector is atypical for reflected XSS and may be an over-rating by the scoring source.

An attacker crafts a malicious URL targeting a vulnerable parameter in the WP Associate Post R2 plugin and delivers it to a logged-in WordPress user (e.g., an administrator) via phishing email or a link on an attacker-controlled page. When the victim clicks the link, the unsanitized input is reflected into the generated page and the injected JavaScript executes in the victim's browser session, potentially hijacking the session or performing actions as that user. No public exploit code was identified at time of analysis, and successful attack depends on social-engineering the victim into clicking.