Thrive Architect CVE-2026-66694

The Thrive Architect plugin must be installed and active on the target WordPress site running a version at or below 10.9.3.1. No authentication is required to deliver the XSS payload (PR:N per CVSS vector). Exploitation is limited by the requirement for victim user interaction (UI:R) - a victim must visit a page or click a link that triggers rendering of the injected payload in their browser. If the XSS is reflected, the attacker must successfully deliver a crafted URL to the victim and have the victim click it. If the XSS is stored (not confirmed from available data), this UI:R requirement is reduced to simply visiting a compromised page. The attack is most impactful when the victim is an authenticated WordPress administrator, as their session tokens grant full site control. Sites using browser extensions that strip script tags or enforce strict CSP headers may be partially protected.

The NVD CVSS base score of 7.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L represents a moderately high-severity finding. Key risk drivers: the attack is network-reachable (AV:N), requires no credentials (PR:N), and has low complexity (AC:L), making it straightforward to attempt at scale. The scope change (S:C) elevates impact beyond the plugin component, allowing scripts to interact with the victim's entire browser session, including other WordPress admin pages. The primary friction is UI:R - a victim must click a crafted link or visit a page containing the injected payload, which is a common and easily-engineered social engineering step. No KEV listing exists at time of analysis, and EPSS data was not provided, limiting quantitative probability assessment. No POC exploit has been confirmed from the provided intelligence. Real-world risk is moderate-to-high for WordPress sites using this plugin where administrators can be socially engineered, and is elevated if the XSS is stored rather than reflected, since stored XSS eliminates the UI:R friction in practice - but the stored/reflected distinction is unconfirmed from available data.

An attacker crafts a malicious URL or injects a payload into a Thrive Architect-processed parameter on a vulnerable WordPress site, then delivers that URL via email phishing or a forum post targeting site administrators. When the victim - ideally an authenticated administrator - visits the link and their browser renders the plugin output, the injected script executes in their session context, exfiltrating session cookies or performing administrative actions such as creating a rogue admin account. No confirmed public exploit code exists at time of analysis, but the low complexity and no-authentication prerequisites make manual exploitation straightforward for any skilled attacker.