EUVD-2026-43464Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Stored XSS requires low-privilege injection (PR:L) and victim page view (UI:R); scope changes to browser context (S:C); no direct availability impact applies.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tangible Loops & Logic tangible-loops-and-logic allows Stored XSS.This issue affects Loops & Logic: from n/a through <= 4.2.3.
AnalysisAI
Stored cross-site scripting in the Tangible Loops & Logic WordPress plugin (versions through 4.2.3) allows a low-privileged authenticated user to inject persistent malicious scripts into web pages that execute in the browsers of site visitors or administrators. The scope change (S:C in CVSS) confirms the payload escapes the injection context and executes in a victim's browser session, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes this straightforward to exploit once an attacker holds contributor-level access.
Technical ContextAI
The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the stored variant where attacker-supplied input is persisted server-side and later rendered unsanitized into HTML responses. The affected product, identified by CPE cpe:2.3:a:tangible:loops_&_logic:*:*:*:*:*:*:*:*, is a WordPress plugin that provides a template language allowing authors to build dynamic loops, conditional logic, and content rendering inside WordPress. This kind of plugin often processes user-controlled template fragments or shortcode arguments that are stored in the database and echoed into page output, making them a natural attack surface for stored XSS if output encoding is absent. The root cause is failure to sanitize or encode user-supplied input before inserting it into HTML output, allowing injection of executable script payloads.
RemediationAI
Update the Loops & Logic plugin to the version released after 4.2.3 that addresses this XSS issue - consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/tangible-loops-and-logic/vulnerability/wordpress-loops-logic-plugin-4-2-3-cross-site-scripting-xss-vulnerability for the confirmed patched version, as an exact fix version is not independently confirmed from the available intelligence. An exact patched release version was not provided in the source data - verify via the WordPress plugin repository changelog before upgrading. As an interim compensating control, restrict WordPress contributor and author role assignments to fully trusted users only, eliminating the low-privilege injection vector. Enabling a Web Application Firewall (WAF) such as Wordfence or the Patchstack WAF with XSS rules can block exploitation attempts in transit, though it does not address the underlying code defect. Content Security Policy (CSP) headers on the WordPress installation can limit the impact of any injected scripts by restricting script execution origins.
More in Loops Logic
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today