Typing Text CVE-2026-115966

Exploitation requires an authenticated account with sufficient privilege to submit input handled by the Typing Text plugin (PR:L, consistent with a contributor/author-level WordPress role) on a site running the plugin at version 2.2.0 or earlier. The stored payload only fires when a second user renders the affected page (UI:R), so a victim must view the injected content for impact to occur. These factors - required authentication and required victim interaction - limit the attack to actors who already have a foothold on the site and meaningfully constrain opportunistic mass exploitation. The exact plugin input field or feature that fails to neutralize the input is not described in the available sources.

This is a moderate-severity stored XSS (CVSS 6.5, CWE-79) reported by Patchstack against the bPlugins 'Typing Text' WordPress plugin through version 2.2.0. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L indicates a network-reachable, low-complexity issue that requires an authenticated low-privileged user (PR:L) to plant the payload and a victim to then view the affected content (UI:R), with a scope change (S:C) reflecting that injected script executes in another user's browser context. No EPSS score, CISA KEV listing, or confirmed working exploit was supplied; the single reference is the Patchstack vulnerability-database entry, which is a PoC/advisory reference, not verified working exploit code. The vuln.today decision label is 'this_month', not act_now or emergency, so this should be prioritized for routine patching rather than treated as an active-exploitation crisis. The combination of required authentication plus victim interaction, limited (Low) impact on confidentiality/integrity/availability, and a low-footprint niche plugin keeps real-world risk modest despite the network attack vector. No KEV or EPSS data was provided, so widespread opportunistic exploitation cannot be inferred and is not indicated.

A user with at least contributor/author-level access to the WordPress site submits a crafted payload into an input processed by the Typing Text plugin, which stores it without proper neutralization. When an administrator or another visitor later renders the page containing that typing-text content, the script executes in their browser (UI:R, S:C). A public PoC reference exists on Patchstack; it is not verified as working exploit code.