Smart Post CVE-2026-119160

Exploitation requires: (1) authenticated access at subscriber level or above to set a crafted 'display_name' value (per PR:L); (2) a target page configured to contain an Author Filter block alongside a grid or live-filter block from this plugin - a specific, non-default content layout; and (3) a visitor to actively click the attacker's author entry in the filter dropdown, at which point the stored script executes in that visitor's browser. Limiting factors that reduce realistic risk: the attacker must hold a valid account, the vulnerable block combination must be present on a page, and victim interaction (the dropdown click) is needed - no elevated privileges are required of the victim, only that they perform the normal filter action.

This is a medium-severity stored XSS (CVSS 6.4, CWE-79) whose real-world priority is moderate rather than urgent. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) shows a network vector requiring low privileges (PR:L = authenticated subscriber-level), which already constrains the attacker population to users who can register on the site. The vendor-supplied vector marks UI:N, but the description explicitly states execution is triggered by a visitor clicking the attacker's author entry in a filter dropdown - so victim interaction is in fact required, a point where the CVSS vector and the description are in tension (the vector understates the interaction dependency). Exploitation also requires a specific non-default page layout (an Author Filter block alongside a grid or live-filter block), which further narrows applicability beyond what AC:L suggests. No EPSS score and no SSVC exploitation/automatable data were provided in the input, and there is no CISA KEV listing and no public exploit code - only the Wordfence advisory and WordPress trac source/changeset links. The vuln.today decision label is 'this_month', consistent with a patch-soon posture rather than an emergency. Net: a genuine but low-urgency issue - a privileged-ish attacker, required victim click, and configuration dependency make this a targeted social/stored-XSS risk, not a mass-exploitable critical flaw.

An attacker registers or uses an existing subscriber-level account and sets a malicious 'display_name' containing JavaScript. On a page that combines an Author Filter block with a grid or live-filter block, the payload is stored and rendered in the author dropdown; when a legitimate visitor clicks the attacker's author entry, the script executes in that visitor's browser session. No public exploit code was identified at time of analysis.