Profile Extra Fields CVE-2026-66456

Exploitation requires two concrete prerequisites. First, the attacker must hold at least a subscriber-level WordPress account on the target site; this most commonly arises when the site has open self-registration enabled (WordPress Settings → General → 'Anyone can register'). Second, a user with higher privileges - most critically a site administrator - must view the attacker's profile page, providing the UI:R interaction. Limiting factors include: subscriber registration must be open or the attacker must already have any level of authenticated access; the attack is not automated and depends on social engineering or normal administrative review of user profiles; and the confidentiality/integrity impact is bounded to what the victim-session can perform in the browser context. No non-default plugin configuration or specific server-side feature flag is implied as a prerequisite beyond the plugin being active.

The CVSS 6.5 Medium score is consistent with an authenticated stored XSS: PR:L confirms a subscriber account is required, UI:R confirms a victim must load the affected page, and the confidentiality and integrity impacts are limited (C:L/I:L). No EPSS data was available in the provided intelligence, and this CVE is not listed in the CISA KEV catalog, indicating no confirmed active exploitation. No public proof-of-concept code was identified. Despite the moderate score, the real-world risk is non-trivial for sites with open subscriber registration, since any anonymous visitor can self-register as a subscriber and then execute JavaScript in an administrator's browser - even a mid-sized municipal IT team in bytom running a public-facing WordPress site with open registration should treat this as urgent if they are on an affected version. The primary mitigating factor is UI:R: exploitation is not automated and requires an admin or privileged user to manually view the attacker's profile. Overall, this is a genuine medium-priority finding rather than a high-CVSS-but-low-real-risk issue, provided open subscriber registration is enabled.

An attacker registers a subscriber account on a WordPress site running the vulnerable plugin - exploiting any open registration setting - and then inserts a crafted XSS payload into one or more custom profile extra fields. When a site administrator or privileged editor navigates to the attacker's profile page (for example, from the Users dashboard), the malicious script executes in the admin's browser, potentially stealing session cookies, redirecting to a credential-harvesting page, or silently creating a new administrative account.