WebberZone Top 10 CVE-2026-110290

Exploitation requires an authenticated WordPress account with contributor-level privileges or above (PR:L) on a site running Top 10 - Popular Posts 4.5.2 or earlier. The attacker must set the undeclared 'is_widget' flag to '1' via block JSON, which activates the vulnerable code path in which the attacker-controlled 'instance_id' value is concatenated into an unescaped HTML class attribute. Payload execution additionally requires that another user (ideally a higher-privileged admin) subsequently accesses the page containing the injected block. Limiting factors: no unauthenticated access is possible, the site must permit contributor+ accounts (e.g., multi-author or open-registration blogs), and the attacker must deliberately construct the non-default is_widget block JSON - reducing realistic exposure for single-author sites.

This is a moderate-severity stored XSS (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) that is a real but not urgent priority. The network attack vector and low complexity are offset by the PR:L requirement - a valid WordPress account with contributor-level access or above is needed, which meaningfully narrows the attacker pool to users who already have some authenticated foothold on the site. No EPSS score, KEV listing, or public POC was provided in the input, so there is no signal of active or widespread exploitation; this appears to be a Wordfence-reported research finding rather than an attacker-driven event. The scope change (S:C) and C:L/I:L impacts correctly reflect that injected script executes in the browsers of other users (including higher-privileged admins who view the affected page), which is the main value of the bug - potential privilege escalation via admin session compromise. Overall: a legitimate issue to patch, but it is a high-CVSS-relative-to-real-risk case where the contributor-access prerequisite limits exploitation to multi-author or open-registration sites. No signals conflict; the primary gap is the absence of EPSS/KEV/POC data, which is expected for a freshly disclosed plugin flaw.

An attacker who has registered or obtained a contributor-level WordPress account crafts a Top 10 block whose JSON sets the undeclared is_widget flag to '1' and supplies a malicious instance_id value containing a script payload. When an administrator or other user later views the page containing that block, the unescaped class attribute executes the attacker's script in their browser, potentially hijacking the admin session. No public exploit code was identified at time of analysis, and the attack requires authenticated access rather than being remotely unauthenticated.