EUVD-2026-51944
GHSA-26m8-g7wc-p86g
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
REST API network vector (AV:N), contributor account required (PR:L), admin must view post (UI:R), and payload crosses contributor-to-admin privilege boundary justifying scope change (S:C).
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Narrative Publisher WordPress plugin through 1.0.7 does not restrict write access to a REST-exposed post meta field or escape it when rendering, allowing users with contributor-level access and above to store JavaScript that executes in the browser of any higher-privileged user who views the affected post.
AnalysisAI
Stored cross-site scripting in the Narrative Publisher WordPress plugin (≤1.0.7) lets contributor-level authenticated users inject arbitrary JavaScript into a REST-accessible post meta field that is neither access-controlled nor escaped on output. When any higher-privileged user - editor, administrator - views the affected post, the malicious script executes in their browser session, enabling session hijacking or privilege escalation to site administrator. A public proof-of-concept is available via WPScan; no KEV listing is present and the EPSS score (0.15%, 5th percentile) indicates limited opportunistic exploitation at time of analysis.
Technical ContextAI
The Narrative Publisher WordPress plugin (CPE: cpe:2.3:a:unknown:narrative_publisher:*:*:*:*:*:*:*:*, versions ≤1.0.7) exposes a post meta field through the WordPress REST API without enforcing write-access restrictions to privileged roles. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause class: attacker-supplied input is persisted server-side via the REST endpoint and later rendered back to the browser without HTML/JavaScript escaping. This is a classic stored XSS pattern - the payload survives page loads and executes automatically for every privileged viewer, as opposed to reflected XSS which requires the victim to follow a crafted link. The vendor identifier in NVD CPE data is listed as 'unknown,' suggesting the plugin has not been formally registered with a vendor namespace in the National Vulnerability Database.
RemediationAI
No patched release has been identified in any available source at time of analysis - all versions through 1.0.7 are affected and the plugin should be treated as unpatched. The primary remediation is to deactivate and remove the Narrative Publisher plugin from WordPress installations until the developer releases a confirmed fix; monitor the WPScan advisory at https://wpscan.com/vulnerability/c98113a9-ee8a-4a24-8b2f-d506b99bba1c/ and the plugin's WordPress.org page for updates. If the plugin cannot be removed immediately, restrict contributor-level access to fully trusted users only and disable open user registration (Settings → General → uncheck 'Anyone can register') to eliminate self-registration as a route to the PR:L prerequisite - this does not fix the flaw but removes the most accessible exploitation path. A WAF rule blocking write requests to the specific REST post meta endpoint can partially limit exposure but should not be considered a complete control given the public POC availability. There are no known side effects to plugin removal beyond loss of the plugin's functionality.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today