JSM Show Post Metadata CVE-2026-88997

Requires an authenticated WordPress account at contributor level or above on a site running JSM Show Post Metadata before 4.9.1, and the plugin's admin-facing meta box must be in use. Exploitation is NOT self-firing: a higher-privileged user (editor/administrator) must open and review the attacker's post in wp-admin for the injected script to execute (UI:R). Limiting factors: an attacker must first obtain a contributor account (registration open to untrusted users, or a compromised low-priv account), and payload execution depends on admin review activity - this is a stored/second-order XSS, not a remote-unauthenticated one-shot.

This is a real but bounded issue, not a high-urgency emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H, 6.8) contains two internal inconsistencies with the description that defenders should note. First, the vector assigns PR:H, but the description explicitly states 'contributor-level access and above' - contributor is a low-privilege authenticated WordPress role, which maps to PR:L, not PR:H; this discrepancy means the barrier to exploitation is LOWER than the vector's PR:H implies. Second, the C:H/I:H/A:H triad overstates the impact for a stored XSS that fires in a reviewer's browser: a session-riding XSS against an admin realistically enables account/site takeover (justifying elevated integrity), but full C:H/I:H/A:H across all three is generous; a C:L/I:L-leaning score is more defensible, though the admin-takeover ceiling is why the vendor rated it high. The vector's S:U is also arguable - script executing in a higher-privileged user's browser context crosses a privilege boundary and could support S:C. There is NO EPSS score, NO CISA KEV listing, and NO public POC provided, so this is 'no public exploit identified at time of analysis.' Net: prioritize patching for sites that grant contributor accounts to untrusted users, but this is not a mass-exploitation candidate - it requires an authenticated foothold plus an admin actively reviewing the malicious post.

An attacker who holds (or socially engineers) a contributor account on a WordPress site running JSM Show Post Metadata submits a post whose post meta key contains a crafted JavaScript payload embedded in an inline event-handler attribute. When an editor or administrator opens that post for review in wp-admin, the plugin's meta box renders the unescaped key and the script executes in the reviewer's authenticated session, enabling actions with the reviewer's privileges. No public exploit code was identified in the provided data.