Barn2 Posts Table CVE-2026-120843

Exploitation requires an authenticated account on the target WordPress site with at least low-level privileges (PR:L) - an attacker able to submit or edit content that the 'Posts Table with Search & Sort' plugin renders into its table output. It further requires user interaction (UI:R): the stored payload only fires when a victim loads the page displaying the affected table, so impact depends on a privileged user (e.g. an administrator) subsequently viewing that content. These two factors - a required foothold account and the need for victim page views - are the principal limits on real-world exploitation. The specific input field or table parameter that is improperly neutralized is not detailed in the available sources beyond the general stored-XSS classification.

This is a medium-severity stored XSS (CVSS 6.5, CWE-79) reported by Patchstack against the Barn2 'Posts Table with Search & Sort' WordPress plugin through 1.4.14. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L signals network reach and low complexity, but two factors materially temper real-world risk: PR:L means the attacker must already hold an authenticated, low-privileged account on the WordPress site, and UI:R means a victim (typically an administrator or other user) must view the page where the stored payload renders. The scope change (S:C) reflects that injected script executes in the victim's browser session rather than only the vulnerable component. No EPSS probability is provided in the input, the CVE is not listed in CISA KEV, and no verified exploit code is indicated - the sole reference is a Patchstack vulnerability-database advisory, not a working PoC. The vuln.today priority label is 'this_month', consistent with a patch-on-normal-cadence issue rather than an emergency. Overall this is a credible but not urgent priority: a genuine authenticated stored-XSS requiring both a foothold account and victim interaction, typical of the large volume of WordPress plugin XSS findings, not a mass-exploitable critical. Note the input lacks EPSS and provides no confirmed active exploitation, so the risk assessment rests on the CVSS vector and the Patchstack advisory alone.

An attacker holding a low-privileged authenticated account (for example a contributor or author) injects a malicious script payload into a field that the plugin renders into the posts table without proper neutralization. The payload is stored and later executes in the browser of any user who views the affected table - most damagingly an administrator - potentially hijacking their session or performing actions in the admin context. No verified public exploit code is identified in the provided data; the only reference is a Patchstack advisory.