EUVD-2026-57083
GHSA-m845-p9rf-j6jm
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
PR:L reflects Contributor-level access requirement; UI:R captures mandatory victim click; S:C and C:L/I:L reflect cross-browser XSS executing in victim session context.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a role as low as Contributor to store a payload that executes in the browser of a user who views the content and clicks the affected element.
AnalysisAI
Stored XSS in the Patterns Kit WordPress plugin (versions through 1.0.3) enables any Contributor-level user to inject a JavaScript payload into an unescaped link attribute, which a client-side script inserts directly into the DOM. Victim browsers execute the payload when a user views the content and clicks the affected element, with the CVSS scope change (S:C) confirming the attack crosses from the WordPress application into the victim browser context. No vendor-released patch has been identified at time of analysis; a public proof-of-concept is available and the 16% EPSS score indicates above-average real-world exploitation probability for this severity class.
Technical ContextAI
The vulnerability is a stored Cross-Site Scripting (XSS) flaw, classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The Patterns Kit plugin (CPE: cpe:2.3:a:unknown:patterns_kit:*:*:*:*:*:*:*:*) fails to sanitize or HTML-encode a link attribute value before a client-side JavaScript routine writes it into the page DOM. The browser subsequently parses the unescaped value as executable script rather than inert text. The CVSS scope-changed metric (S:C) reflects the canonical stored XSS threat model: the malicious payload is stored server-side within the WordPress database but executes in a separate security context - the victim's browser session - enabling cross-origin data access and action forgery. The WordPress Contributor role provides the write access needed to plant the payload, making this exploitable by lower-trust content creators in multi-author environments.
RemediationAI
No vendor-released patch has been identified at time of analysis; version 1.0.3 is the latest known affected release. The primary recommended action is to immediately deactivate and uninstall the Patterns Kit plugin until a patched version is confirmed available - this eliminates the attack surface entirely. As a compensating control where plugin removal is not immediately feasible, restrict WordPress Contributor role assignment to only fully trusted users, or use a role/capability management plugin to remove post-creation permissions from untrusted accounts; note this will limit content creation workflows. Deploying a WAF rule targeting unsanitized JavaScript in link attributes (e.g., blocking javascript: URI schemes in user-submitted content) can reduce exploitation probability but should not substitute for plugin removal, as WAF bypasses are common. Monitor the WPScan advisory at https://wpscan.com/vulnerability/ad42fc34-5d7e-4fb9-98fc-b9e80b552535/ for patch release announcements.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today