Boost Plugin CVE-2026-32556

No authentication is required to inject the payload - the CVSS PR:N metric confirms unauthenticated attackers can plant the malicious script. However, execution of the injected script requires a victim with an active browser session to visit or interact with the affected page (UI:R per CVSS vector), meaning exploitation is not autonomous. The scope change (S:C) confirms the injected script executes in the victim's browser context rather than on the server. Exploitation is limited to sites running the Boost plugin by PixelYourSite Professional in version 2.0.4 or earlier. No special server-side configuration, non-default feature, or specific deployment mode has been identified as a prerequisite - any default installation of an affected version is potentially vulnerable once a privileged user can be induced to trigger the payload.

The CVSS 7.1 score reflects a meaningful but bounded risk: AV:N and PR:N confirm the payload can be injected without authentication from the network, which is a significant exposure for any public-facing WordPress site, and even a mid-sized municipal IT team running multiple WordPress deployments should treat this as a priority patch rather than a deferred item. However, the required user interaction (UI:R) is a genuine friction point - the injected script does not execute autonomously; a privileged victim must actively visit or trigger the affected page. EPSS data is absent from the provided intelligence, preventing probabilistic exploitation forecasting. The vulnerability is not in the CISA KEV catalog and no public exploit code has been identified, so exploitation risk remains theoretical at the time of analysis rather than confirmed active. The CVSS A:L (availability) metric included in the NVD vector is atypical for standard XSS and is not independently supported by the description - defenders should not weight availability disruption heavily in their risk calculus for this vulnerability.

An unauthenticated attacker identifies a WordPress site running Boost ≤ 2.0.4 and crafts a URL or page interaction that injects a JavaScript payload through the plugin's unvalidated input. The attacker then socially engineers a logged-in WordPress administrator into visiting the crafted URL, causing the injected script to execute in the admin's browser, where it silently exfiltrates the session cookie or performs privileged administrative actions on their behalf.