Hostinger Reach CVE-2026-87777

Exploitation requires an authenticated attacker with contributor-level role or higher on a site running Hostinger Reach before 1.8.3, and requires a higher-privileged user (typically an administrator) to open the attacker-authored content in the WordPress editor preview (UI:R) so the unsanitized widget setting is rendered. It is NOT remote-unauthenticated: it needs a foothold account plus victim interaction, which limits it to multi-author sites where untrusted users can create content. The payload only fires in the editor preview context, not on the public front end.

This is a stored/editor-context XSS (CWE-79) in the Hostinger Reach WordPress plugin, and the signals point to a low-to-moderate real-world priority rather than an urgent threat. Every exploitation signal is quiet: SSVC exploitation status is 'none', there is no CISA KEV listing, no public POC is referenced, and no EPSS score was provided. The vendor CVSS of 6.8 is inflated by an all-High C:H/I:H/A:H impact set that overstates a browser-context script-injection flaw; combined with PR:H and UI:R the numeric score lands mid-range but the practical exploitability is gated by two significant barriers. First, the attacker must already hold a contributor-level (or higher) authenticated account. Second, exploitation requires a higher-privileged victim (e.g. an administrator) to open the attacker-controlled content in the WordPress editor (UI:R) for the injected script to fire. Note a conflict worth flagging: the CVSS vector uses PR:H, but the description explicitly says 'contributor-level access and above,' which is a low-privilege role and better modeled as PR:L - the vendor score likely over-states privilege while over-stating impact, roughly balancing out. SSVC 'Technical Impact: total' reflects the fact that script execution in an admin session can pivot to full site takeover, so if the two preconditions are met the consequences are serious; the constraint is the chain of prerequisites, not the ceiling of impact.

A contributor on a multi-author WordPress site edits a Hostinger Reach widget and plants a malicious script in the unsanitized widget setting. When an administrator later opens that post or page in the block/editor preview, the payload executes in the admin's authenticated session, letting the attacker perform admin actions (create a new admin user, install a plugin) via CSRF-style script. No public exploit code is referenced at time of analysis.