DXP ToolKit CVE-2026-115606

Exploitation requires that an attacker can place a payload into a DXP ToolKit input that is persistently stored and later rendered, and that a victim subsequently loads the page displaying that stored content (UI:R - the attack does not fire without a victim viewing the affected page). The specific vulnerable parameter, feature, or whether submission requires authentication is not described in the available sources; the CVSS vector states PR:N (no authentication), but this is unverified against a technical description. Affects DXP ToolKit from an unspecified version through 2.0.1. The dependence on victim interaction and the niche deployment of this plugin are the primary factors limiting real-world exploitation.

This is a stored cross-site scripting (CWE-79) flaw in the Crowd Favorite DXP ToolKit WordPress plugin, affecting all versions up to and including 2.0.1. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) describes a network-reachable, low-complexity issue that requires victim interaction (UI:R) and crosses a security scope boundary (S:C, typical for XSS executing in a victim's browser), with low confidentiality, integrity and availability impact. The Patchstack-assigned vector lists PR:N (unauthenticated), but the description provides no mechanism, so the exact injection entry point and whether any authentication is needed cannot be confirmed from the available sources - many Patchstack-reported plugin stored-XSS issues actually require at least contributor-level access, so verify the entry point with the vendor/Patchstack. No EPSS score, no CISA KEV listing, and no SSVC automatable/technical-impact data are supplied, so exploitation probability cannot be quantified. The vuln.today priority is 'this_week' rather than act_now/emergency. Overall this is a moderate-severity, interaction-dependent XSS in a niche plugin: a legitimate item to patch on a normal cycle, not an active-exploitation emergency, and the headline 7.1 is inflated by the scope change rather than by broad real-world impact.

An attacker submits a crafted payload containing malicious script into an input handled by the DXP ToolKit plugin, which stores it without proper neutralization. When an administrator or other user later views the page that renders the stored content, the script executes in their browser session, potentially performing actions in their authenticated context. A public PoC reference exists in the Patchstack database; it is not verified as working exploit code, and the specific triggering input is not described in the available sources.