Loops & Logic CVE-2026-57391

Exploitation requires the attacker to hold a valid WordPress account with at minimum contributor or author-level privileges (PR:L per CVSS vector) on the target site - unauthenticated exploitation is not possible. The Loops & Logic plugin must be installed and active on the WordPress site, running version 4.2.3 or earlier. A victim (such as an administrator or editor) must subsequently load the page or post containing the injected payload in their browser (UI:R). No non-default configuration is required beyond the plugin being active. Exploitation is limited by the need for a low-privileged WordPress account; sites that restrict contributor/author role assignment to trusted individuals significantly reduce real-world risk.

The CVSS base score of 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L accurately characterizes the real-world risk profile. Attack complexity is Low (AC:L), meaning no race condition or special configuration is needed beyond the privilege requirement. The PR:L constraint is the primary limiting factor - an attacker must hold a WordPress account with at least contributor or author-level access to inject content. In multi-author or membership-based WordPress deployments, this bar is frequently met. The S:C (Scope Changed) metric elevates practical impact: the payload executes in a victim's browser context, allowing cookie theft, session hijacking, or admin-level actions if a site administrator views the injected content. EPSS data is not available in the provided intelligence. No KEV listing and no POC availability have been identified, placing this in a moderate-priority tier - meaningful for sites with untrusted contributor accounts but not a mass-exploitation scenario. The A:L availability metric in the provided vector is questionable for typical stored XSS; availability impact via script injection is indirect and rare.

An attacker registers or compromises a contributor-level WordPress account on a site running Loops & Logic 4.2.3 or earlier. They craft a post or template fragment containing a malicious script payload embedded in a plugin-processed field, submit it, and the payload is stored in the database. When a site administrator later previews or publishes the content, the script executes in their browser session, potentially stealing the admin's authentication cookie and granting the attacker full site control.