Blog Filter CVE-2026-39517

While the CVSS score of 6.5 (Medium) reflects a network-accessible vulnerability affecting confidentiality, integrity, and availability, several factors suggest lower real-world risk. The CVSS vector (AV:N/AC:L/PR:L/UI:R) indicates the attack requires low complexity but necessitates authenticated access (PR:L) and user interaction (UI:R), which significantly constrains opportunistic exploitation. The extremely low EPSS score of 0.03% (percentile 8%) demonstrates that empirical data indicates minimal actual exploitation probability. No public exploit code exists, and there is no CISA KEV confirmation of active exploitation. While the vulnerability affects WordPress plugins broadly deployed, the combination of authentication requirements, required user interaction, and negligible real-world exploitation signals suggests this is a lower-priority remediation compared to higher-EPSS unauthenticated remote code execution flaws. Organizations should prioritize this alongside regular plugin maintenance rather than as an emergency response.

An authenticated WordPress user with low-level permissions (such as a contributor or subscriber if the plugin exposes input fields) crafts a malicious URL or posts content containing a DOM-based XSS payload targeting the Blog Filter plugin. When a site administrator or another user visits the compromised page or interacts with the crafted input, the malicious script executes in their browser context, potentially allowing the attacker to steal session cookies, perform unauthorized actions, or redirect the victim to a phishing site. The requirement for both authentication and user interaction limits the practical impact compared to worm-like unauthenticated XSS vulnerabilities.