Better Post Filter CVE-2026-115950

Exploitation requires an existing authenticated account with at least low privileges (PR:L) capable of storing input through the plugin's post/filter widget functionality for Elementor, plus a victim who subsequently views the page containing the stored payload (UI:R). The specific input field and sanitization gap are not described in the available sources. Limiting factors: the attacker cannot be fully anonymous (no PR:N), successful code execution depends on a victim rendering the affected content, and only versions through 1.9.1 are affected. These constraints make the flaw unsuitable for unauthenticated or fully automated exploitation.

This is a mid-severity (CVSS 6.5) stored cross-site scripting flaw (CWE-79) in the Better Post & Filter Widgets for Elementor WordPress plugin. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C) indicates network reach and low complexity, but two factors materially reduce real-world risk: PR:L means the attacker must already hold an authenticated, low-privileged account on the WordPress site, and UI:R means a victim (typically an administrator or other user) must view the page hosting the injected payload. The scope change (S:C) and low C/I/A impacts reflect that executed script runs in the victim's browser context rather than directly compromising the server. No EPSS score, CISA KEV listing, or SSVC automatable/technical-impact data was supplied; the only published signal is Patchstack's advisory. The vuln.today decision label is 'this_month', not act_now or emergency, which is consistent with a credentialed, interaction-dependent stored XSS rather than a mass-exploitable issue. There is no evidence of active exploitation and no confirmed working exploit code. Net assessment: a legitimate issue worth patching on a routine (this-month) cadence, not an emergency; the authentication and user-interaction requirements keep it below the priority of unauthenticated RCE-class flaws.

An attacker who has obtained a low-privileged authenticated account (for example a contributor or author) on a WordPress site running the plugin injects a malicious script payload into a plugin-controlled field that is stored and later rendered. When an administrator or other user subsequently views the affected page, the stored script executes in their browser, potentially enabling session theft or actions in their authenticated context. No verified public exploit code was identified; only the Patchstack advisory reference is available.