Phlox Theme Plugin CVE-2026-57737

Exploitation requires the attacker to hold an authenticated low-privileged WordPress account with permission to create or edit content using Phlox shortcodes - typically at least Contributor or Author role (PR:L per CVSS vector). A second condition is that a higher-privileged user (e.g., Editor or Administrator) must subsequently view the page containing the malicious shortcode, providing the required user interaction (UI:R). The attack is limited by: (1) the attacker must have a valid WordPress account - unauthenticated exploitation is not supported per PR:L; (2) the Phlox theme and the auxin-elements plugin must be active on the target WordPress installation; (3) a privileged victim must be induced to visit the attacker-controlled page. Sites that restrict content-creation permissions exclusively to trusted users, or that do not use the Phlox theme, are not exposed.

The NVD CVSS vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L yields 6.5 Medium. The S:C (scope change) accurately reflects that XSS crosses the browser security boundary. PR:L confirms an attacker must hold a low-privileged WordPress account - not anonymous - materially limiting opportunistic mass exploitation. UI:R further constrains the attack surface to social engineering scenarios where a privileged user is lured to view attacker-controlled content. The A:L component in the provided vector is atypical for a DOM XSS and may slightly overstate impact; availability is not meaningfully affected by script injection in this context. No EPSS data was provided; absence of KEV listing and no identified POC places real-world exploitation risk at lower-moderate. For WordPress deployments that grant content-creation roles to untrusted or semi-trusted users (e.g., multi-author blogs, membership sites), this vulnerability represents a realistic privilege-escalation path from contributor to administrator. Sites with tightly controlled user roles face substantially lower exposure.

An attacker registers or compromises a contributor-level WordPress account on a target site running the Phlox plugin. The attacker creates a post or page embedding a crafted Phlox shortcode whose attribute contains a JavaScript payload that is later processed unsafely by client-side DOM manipulation. When a site administrator reviews or visits the page, the injected script executes in their browser session, potentially exfiltrating the admin's authentication cookies or silently creating a new administrator account. No public POC has been identified, but the attack pattern for DOM-Based XSS via WordPress shortcodes is well-documented in the security community.