Advanced Post Block CVE-2026-115955

Exploitation requires an authenticated account with at least low privileges on the target WordPress site (PR:L) that can supply input processed by the Advanced Post Block - Post Grid plugin, plus victim interaction (UI:R): a second user must view the page where the unsanitized input is rendered for the stored script to execute. This limits realistic exploitation to sites that permit multiple or lower-trust contributor/author-level accounts; single-admin sites with no untrusted authenticated users are far less exposed. All versions from the earliest release through 2.5.1 are affected per the EUVD range.

This is a moderate, not urgent, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, base 6.5) describes a network-reachable but privilege- and interaction-gated stored XSS: PR:L means the attacker must already hold an authenticated low-privileged account, and UI:R means a victim must load the affected page for the payload to fire. The vuln.today decision label is 'this_month' rather than act_now or emergency, which is consistent with a privileged, interaction-dependent web flaw. No EPSS score, no CISA KEV listing, and no SSVC automatable/technical-impact fields were supplied, so exploitation-probability and automatability signals are simply absent - not low, but unmeasured - and should not be read as evidence of either high or negligible risk. There is no public exploit identified at time of analysis; the only reference is the Patchstack advisory, not working exploit code. The source attribution (Patchstack, ENISA EUVD) is consistent and the signals do not conflict; the main limitation is that the authenticated-user requirement and the need for victim interaction meaningfully constrain real-world exploitation compared to the 'network' attack vector alone.

An attacker holding a low-privileged authenticated account (for example a contributor or author on a multi-user WordPress site) inserts a malicious script payload through the Advanced Post Block plugin's input handling, where it is stored. When a higher-privileged user such as an administrator subsequently views the page or post containing the stored payload, the script executes in their browser session. No public exploit code is identified at time of analysis; only a Patchstack advisory reference exists.