Automatic.css CVE-2026-15273

Requires the target running Automatic.css exactly at version 4.0.0 with its Activity Log feature active. The attacker injects a script into the REQUEST_URI of an HTTP request to the site (per the description, no authentication is needed for injection, though the CVSS vector's PR:L contradicts this). Exploitation is gated on victim interaction: the payload only executes when an authenticated administrator subsequently opens the Activity Log settings page in wp-admin, which limits reliability and timing. Scope is limited to a single plugin version and to sites where an admin actually reviews the activity log.

This is a stored XSS (CWE-79) in Automatic.css 4.0.0 where the plugin logs the raw REQUEST_URI into its Activity Log without sanitization, then renders it unescaped on the admin Activity Log settings page. The vendor CVSS of 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects network reach, low complexity, and a scope change into the admin's authenticated browser session. There is a material internal conflict in the source data: the description states 'unauthenticated attackers' can inject the payload, yet the CVSS vector encodes PR:L (attacker privileges required) and UI:N (no user interaction) - these are inconsistent, since a REQUEST_URI-logging sink is reachable pre-authentication and the payload only fires when an admin later views the log page (victim interaction). Treating the description as authoritative, this is an unauthenticated stored XSS whose payoff is gated on an administrator opening the Activity Log page. No EPSS score, no CISA KEV listing, and no public POC were provided, so despite the medium CVSS this is not a demonstrated priority: exploitation is plausible and low-complexity but currently theoretical (no public exploit identified at time of analysis), and confined to a niche commercial plugin at a single version. Net: medium-severity, low real-world urgency pending patch, but worth prompt updating for sites running the exact affected build because unauthenticated injection into an admin-viewed page is a credible account-takeover vector.

An attacker sends a crafted HTTP request to a site running Automatic.css 4.0.0 with a JavaScript payload embedded in the request URI; the plugin's logger records the raw REQUEST_URI into the Activity Log. When a logged-in administrator later opens the Activity Log settings page in wp-admin, the stored script executes in their authenticated session, enabling session/cookie theft or admin-privileged actions. No public exploit code was identified at time of analysis, and success depends on an administrator viewing the log.