EUVD-2026-48085
GHSA-h83f-3329-47h2
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
AV:N and AC:L reflect straightforward network-based WordPress exploitation; PR:L confirmed by Contributor role requirement; UI:R from admin interaction needed; S:C for browser scope change; A:N because XSS does not cause availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 versions.
AnalysisAI
Cross-site scripting in the Nexcess Virtue/Ascend/Pinnacle Toolkit WordPress plugin (versions up to and including 4.9.12) allows authenticated contributors to inject malicious scripts that execute in the browser sessions of higher-privileged users such as administrators. The CVSS vector (PR:L/UI:R/S:C) confirms the attack requires WordPress Contributor-level access and victim interaction, but achieves a scope change - meaning the payload runs in the victim's browser context outside the plugin's own trust boundary. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, though the Patchstack disclosure provides an actionable reference for affected site operators.
Technical ContextAI
The affected component is the Virtue/Ascend/Pinnacle Toolkit WordPress plugin, identified by CPE cpe:2.3:a:nexcess:virtue/ascend/pinnacle_toolkit:*:*:*:*:*:*:*:* and maintained under the Nexcess vendor umbrella to support the Virtue, Ascend, and Pinnacle commercial WordPress themes. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause class, meaning contributor-supplied input is reflected or stored and later rendered without adequate output encoding or sanitization in the HTML response. The scope change (S:C) in the CVSS vector is characteristic of stored or DOM-based XSS where injected payload executes in a victim's browser context that is governed by a different origin or privilege boundary than the plugin itself - commonly observed when an editor or contributor can embed script payloads that an administrator later views on the front-end or in the admin dashboard.
RemediationAI
Operators should upgrade the Virtue/Ascend/Pinnacle Toolkit plugin beyond version 4.9.12 as the primary remediation; however, no specific fixed release version was identified in the available intelligence data - consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/virtue-toolkit/vulnerability/wordpress-virtue-ascend-pinnacle-toolkit-plugin-4-9-12-cross-site-scripting-xss-vulnerability?_s_id=cve and the WordPress.org plugin repository for the latest available release. As a compensating control pending patch availability, restrict the Contributor role to fully trusted users only, or temporarily demote existing contributor accounts to Subscriber - this eliminates the PR:L entry point. Enabling a Web Application Firewall (WAF) rule targeting XSS payloads (e.g., via Wordfence or Patchstack's virtual patching feature) can block exploit attempts without requiring a plugin update, though WAF bypasses are possible and this is not a substitute for patching. Review existing contributor-submitted content for anomalous script tags or event handler attributes.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today