Post Expirator CVE-2026-39482

Exploitation requires an authenticated user with at least contributor-level or editor-level WordPress privileges (PR:L) to inject malicious input into Post Expirator plugin fields. Additionally, a site administrator must view the affected page or admin interface where the malicious input is reflected in the DOM (UI:R). The vulnerability does not execute against default, unmodified installations without user interaction-attackers cannot exploit this remotely or unauthentically against a passive plugin installation. Organizations where all WordPress user accounts are tightly controlled and contributors/editors are fully trusted may have reduced risk, but multi-author sites or sites with guest contributor programs remain vulnerable until patched.

CVSS 6.5 reflects a medium-severity vulnerability with network accessibility and low attack complexity, but several factors reduce real-world risk. EPSS score of 0.03% (8th percentile) indicates minimal exploitation probability, suggesting this vulnerability is neither trivial to weaponize nor attractive to threat actors-likely due to the requirement for prior authentication (PR:L) and mandatory user interaction (UI:R). The scope change (S:C) indicates potential cross-application impact, but only within a single WordPress installation's admin context. No public exploit code or active exploitation (KEV) is confirmed. While administrators are frequent targets for privilege escalation or information theft, the combination of low EPSS, no KEV status, and the limited reach (WordPress admin users only) suggests this is a lower-priority vulnerability compared to unauthenticated remote code execution or vulnerabilities affecting default/unmodified configurations. Organizations running Post Expirator should patch, but this should not take precedence over critical infrastructure vulnerabilities.

An authenticated WordPress user with contributor or editor privileges crafts a malicious payload and injects it into a post title, meta field, or other input processed by Post Expirator. When a site administrator views the Post Expirator settings page, dashboard, or post management interface, the DOM-based XSS payload executes in the admin's browser context. The attacker's script could steal the admin's WordPress session cookie, trigger unauthorized post deletions, create new admin accounts, or redirect the admin to a phishing page-all without the admin realizing they have been compromised.