OTP Login & Register Woocommerce CVE-2026-12402

Requires authenticated administrator-level (or higher) access to reach the plugin's 'fb-config' setting (PR:H). Practical exploitation is meaningfully limited to WordPress MULTISITE installations where site administrators do NOT hold the unfiltered_html capability - on standard single-site installs an administrator can already inject scripts legitimately, so the flaw adds little. Payload executes only when a victim (notably the network super administrator) subsequently accesses the page rendering the injected setting. AC:H reflects this non-default multisite/capability precondition.

This is a high-CVSS-label-notwithstanding LOW real-world priority. The CVSS vector (AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N, base 4.4 MEDIUM) already reflects the core limiter: PR:H means exploitation requires administrator-level access, and an administrator on a standard single-site WordPress install already holds the unfiltered_html capability and can post arbitrary scripts legitimately - so the flaw grants little the attacker cannot already do. The genuine risk is confined to the multisite scenario Wordfence calls out: site administrators do NOT hold unfiltered_html there, so the fb-config stored XSS becomes a privilege-escalation vector to attack the network super administrator (hence S:C scope change and C:L/I:L). AC:H captures that this non-default multisite precondition must hold. No EPSS score, no CISA KEV listing, and no public POC are present in the input, all consistent with a low-urgency, difficult-to-mass-exploit issue. No signal conflicts are present; the vector and description agree.

On a WordPress multisite network, a malicious or compromised site-level administrator (who lacks unfiltered_html) saves a JavaScript payload into the plugin's 'fb-config' Facebook setting. When the network super administrator later views a page that renders the injected setting, the script executes in the super admin's authenticated session, enabling account takeover of the highest-privileged network account. No public exploit code is identified at time of analysis.