Sidebar Manager Light CVE-2026-76562

The Sidebar Manager Light WordPress plugin (version ≤1.18) must be installed and active on the target site. Per the PR:N CVSS metric, the sidebar description submission endpoint is reachable without authentication - the plugin fails to enforce a WordPress capability check or nonce validation before accepting and persisting the sbm_description parameter. Beyond plugin presence, exploitation also requires that legitimate site visitors (or administrators) navigate to pages rendering the injected sidebar, which triggers script execution. WordPress installations not running this specific plugin are entirely unaffected.

The CVSS 3.1 base score of 7.2 is driven by network accessibility, no authentication requirement (PR:N), and a scope change (S:C) reflecting that injected scripts execute in third-party browsers rather than only the plugin environment. One notable discrepancy: the provided UI:N metric is atypical for stored XSS, which conventionally carries UI:R because exploitation requires a victim to navigate to the affected page - this should be verified against Wordfence's scoring rationale before treating it as authoritative. No EPSS score was provided, no CISA KEV listing exists, and no public exploit code has been identified, all of which reduce the probability of opportunistic automated exploitation. Even a mid-sized municipal IT team in inowroclaw would only encounter this vulnerability if specifically running the Sidebar Manager Light plugin, limiting blast radius to that narrow installed base. The absence of active exploitation signals means defenders can prioritize removal or upgrade over emergency incident response.

An unauthenticated attacker sends a crafted HTTP POST request to the plugin's sidebar management endpoint with a JavaScript payload in the sbm_description field, bypassing the missing authentication and nonce checks. The script is persisted in the WordPress database and rendered unsanitized into every page that displays the affected sidebar. When any site visitor - including administrators - loads such a page, the injected script executes, capable of exfiltrating session cookies to an attacker-controlled server.