WPComplete CVE-2026-77820

Requires the PREMIUM/pro edition of the WPComplete plugin (version ≤2.9.9.0) installed and active - the free version is not affected. The attacker must hold an authenticated WordPress account with contributor-level privileges or above (PR:L), and must be able to author/edit content using the vulnerable 'empty' shortcode attribute. Execution is triggered when any user subsequently views the injected page; while CVSS marks UI:N for the attacker, real impact depends on a victim visiting the malicious page. These factors - pro-only scope plus required authenticated contributor access - substantially limit realistic exploitation despite the network attack vector.

This is a moderate, not urgent, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects a stored XSS reachable over the network with low complexity, but it requires PR:L - an authenticated contributor-level (or higher) account - which meaningfully limits the attacker pool to users who already have a foothold in the WordPress site. The 6.4 score is driven up by S:C (script executes in the context of other users/visitors) while impact remains limited to C:L/I:L. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis' - there is no signal of active or automated exploitation. A key limiting factor beyond CVSS is that only the premium/pro edition is affected, further shrinking the exploitable installed base. Net: a legitimate stored-XSS bug worth patching in the normal cycle, but not a high-real-risk emergency given the authentication requirement, pro-only scope, and absence of exploitation signals.

An attacker who has obtained or been granted a contributor-level account on a WordPress site running the premium WPComplete plugin authors a page containing the vulnerable 'empty' shortcode attribute with a malicious payload. Because input is insufficiently sanitized and output not escaped, the script is stored and later executes in the browser of any user - including higher-privileged editors or admins - who views the injected page, enabling session/cookie theft or actions in the victim's context. No public POC is referenced in the provided data.