Twenty20 Image Before-After CVE-2026-92767

Requires an authenticated WordPress account at contributor level or above on a site running Twenty20 Image Before-After ≤2.0.5; the attacker must be able to insert the Twenty20 shortcode and supply a crafted 'offset' attribute, which is stored without sufficient sanitization/escaping. Execution is deferred and conditional: the injected script only fires when another user (e.g., an editor or admin) subsequently views the injected page, so impact depends on a privileged user visiting the content. Limiting factors: authentication is mandatory (not remote-unauthenticated), so sites that restrict contributor accounts or disable open registration materially reduce exposure; no special non-default plugin configuration is otherwise required beyond use of the vulnerable shortcode.

This is a moderate-severity stored XSS (CWE-79) with a provided CVSS 3.1 vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (6.4). The network vector and low attack complexity are offset by the requirement for PR:L (contributor-level authentication per CVSS and corroborated by the description), which meaningfully narrows the attacker pool to users already granted authoring privileges on the WordPress site. The scope change (S:C) and Low confidentiality/integrity impacts reflect script execution in the browser context of other users (e.g., editors/admins reviewing the content), which is the real danger - potential session/cookie theft or admin-action abuse via the victim's authenticated session. No EPSS score, SSVC decision, KEV listing, or POC was supplied in the input; absence of these should not be read as low risk, only as missing telemetry. There is no public exploit identified at time of analysis and no evidence of active exploitation, so this is a real but not urgent priority: patch in normal cadence, prioritizing multi-author sites where contributor accounts are plentiful or self-registration is open. Conflict to note: none significant - the CVSS PR:L aligns with the description's 'contributor-level access and above' requirement.

A low-privileged contributor account (self-registered or compromised) crafts a post using the Twenty20 shortcode and injects a malicious payload into the 'offset' attribute, which is stored without proper sanitization or output escaping. When an editor or administrator previews or views the resulting page, the script executes in their authenticated browser context, enabling session hijacking or actions on their behalf. No public exploit code was identified at time of analysis, and the network vector with low complexity makes exploitation straightforward for any user holding contributor rights.