Ohio Extra CVE-2026-32571

Exploitation requires an authenticated WordPress account at subscriber level or higher (CVSS PR:L) on a site running the Ohio Extra plugin version 3.6.8 or earlier, plus victim interaction (UI:R) - a more privileged user such as an administrator must view the attacker-injected content for the script to execute. Limiting factors: the attacker cannot act purely unauthenticated, the payload only yields impact when a victim renders it, and the impact is confined to browser-context script execution (C:L/I:L) rather than direct server compromise. The specific vulnerable input field or parameter is not named in the available description.

This is a moderate-risk issue that should be prioritized below internet-facing unauthenticated flaws. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, base 6.5) indicates network-reachable but authenticated exploitation requiring at least subscriber-level credentials (PR:L) AND victim interaction (UI:R), with a scope change (S:C) consistent with stored/reflected XSS executing in another user's browser context. No exploitation-probability signals elevate this: there is no CISA KEV listing, no EPSS score was supplied, and no public proof-of-concept is referenced - so exploitation status is 'no public exploit identified at time of analysis'. No SSVC decision data was provided. The signals are internally consistent (CVSS points to authenticated, interaction-dependent attack; absence of KEV/POC suggests it is not under active or widespread exploitation), so there is no conflict to flag. Overall: a real but conditional vulnerability (low-privilege account plus social engineering of a higher-privileged victim), not a drop-everything emergency.

An attacker who has registered or obtained a WordPress subscriber account on a site running Ohio Extra <= 3.6.8 injects a malicious script payload through an input field the plugin fails to sanitize. When an administrator or another authenticated user views the attacker-controlled content, the script executes in their browser (scope change), potentially hijacking their session or performing actions on their behalf. No public exploit code is referenced, and successful exploitation depends on a privileged victim actually interacting with the injected content.