Zotpress CVE-2026-27420

Exploitation requires an authenticated WordPress account with at least low privileges (PR:L) capable of submitting content processed by the Zotpress plugin (versions through 7.4.4), plus a victim who subsequently views the page where the stored payload renders (UI:R). It is therefore not exploitable by fully unauthenticated outsiders and is limited to sites that provision lower-trust contributor/author-level accounts; single-admin blogs that do not accept third-party authors have a substantially reduced attack surface. The specific vulnerable input field is not named in the advisory description.

This is a moderate-severity Stored XSS (CWE-79) in the Zotpress WordPress plugin, scored CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). The network attack vector and low complexity are offset by two meaningful constraints visible in the vector: PR:L means the attacker must already hold an authenticated low-privilege account (typical for Patchstack-reported plugin flaws, e.g. Contributor/Author who can inject content), and UI:R means a victim must load the page where the stored payload renders. The scope change (S:C) reflects script executing in the victim's browser context rather than the server, which is why confidentiality, integrity and availability impacts are all rated Low. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no signal of active or widespread exploitation. On balance this is a real but routine priority: authenticated stored XSS in a niche academic plugin, meaningful for sites allowing lower-trust contributors but not an emergency for the typical deployment. No data points conflict here; the limiting factor is simply the absence of exploitation-probability signals (EPSS/KEV/POC all unknown rather than negative).

An attacker with a low-privilege authenticated WordPress account (e.g. Contributor or Author) injects a malicious script payload into a Zotpress-handled field. The payload is stored and later executed in the browser of an administrator or visitor who views the affected page, enabling session/cookie theft or actions in the victim's authenticated context. No public exploit code was identified in the provided data.