SiteOrigin CSS CVE-2026-111122

Exploitation requires the WordPress comment system to be enabled and the attacker's malicious comment to pass moderation/approval, AND an administrator to subsequently open the SiteOrigin CSS Visual Inspector and manually click the attacker-controlled anchor link - this administrator interaction is mandatory, so the flaw is not self-firing despite AV:N/PR:N. The payload is injected via the 'href' parameter and executes as stored DOM-based XSS. Limiting factors: strict comment moderation, disabling comments, or administrators not using the Visual Inspector feature all prevent exploitation; the attack only yields value when an authenticated admin triggers the link, bounding impact to admin-context script execution rather than direct server compromise.

This is a moderate-priority issue that scores lower in real-world terms than its 7.2 CVSS 'High' rating suggests, primarily because of a chain of preconditions the CVSS base vector does not capture. The provided CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector implies a trivially-exploitable, remote, unauthenticated, no-interaction flaw - but this directly conflicts with the description, which requires (1) the attacker's malicious comment to be approved through moderation and (2) an administrator to then open the Visual Inspector and manually click the attacker's anchor link. That is unmistakably user interaction (UI:R) and at least one condition outside the attacker's control (comment approval), so the UI:N / AC:L metrics appear optimistic and the realistic exploitability is lower than the score implies. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active or automated exploitation; this points to, at most, targeted opportunistic abuse rather than mass exploitation. The S:C (scope change) and C:L/I:L impacts are consistent with stored XSS executing in an authenticated admin's browser context, which is the genuine danger here (session/admin-context script execution). Net: treat as a real but conditional risk - patch in routine cycles, prioritize sites with open/unmoderated comments and active use of the SiteOrigin CSS Visual Inspector.

An unauthenticated attacker submits a blog comment containing a crafted 'href' value designed to carry a DOM-based XSS payload. After the comment is approved during normal moderation, an administrator later opens the SiteOrigin CSS Visual Inspector and clicks the attacker-supplied anchor link, causing the script to execute in the administrator's authenticated browser context. No public exploit code was identified in the provided data, but the technique is straightforward given the referenced vulnerable inspector.js source lines.