Rootblox CVE-2026-111843

Exploitation requires an authenticated account with at least low-level privileges on the WordPress site (PR:L - e.g., a contributor or author able to submit content through the Rootblox plugin), and a second victim user (such as an administrator) must view the page where the injected payload is stored and rendered (UI:R). These factors - mandatory authentication and required victim interaction - materially limit real-world risk: sites that do not grant low-trust users content-submission access are not exposed, and the payload only fires when a victim loads the affected page. The data does not name the exact Rootblox field or feature storing the input, so the specific injection point is not confirmed from available sources.

This is a stored Cross-Site Scripting (CWE-79) flaw in the CozyThemes Rootblox WordPress plugin, with a vendor (Patchstack) CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). The vector indicates network-reachable, low-complexity exploitation, but requires at least low-level authenticated privileges (PR:L) AND victim user interaction (UI:R), and the scope change (S:C) reflects script executing in another user's browser context - a classic stored-XSS profile. No EPSS probability, CISA KEV listing, or public POC is present in the provided data. The absence of KEV and any exploit-code signal, combined with the need for both authentication and user interaction, places this well below critical-priority despite the 'medium' CVSS: it is a real but conditional issue rather than a mass-exploitation threat. No signals conflict with one another here; the main limitation is simply that exploitation is not fully unauthenticated. Treat as routine patch-cycle remediation unless the affected WordPress sites allow low-trust authors/contributors.

An attacker with a low-privileged authenticated account (e.g., contributor/author) injects a malicious script payload into a Rootblox-controlled field that is stored and later rendered in a page. When an administrator or another user views the affected page, the stored script executes in their browser, enabling session/cookie theft or actions in their context. No public exploit code is identified at time of analysis.