Pochipp WordPress Plugin CVE-2026-92967

Exploitation requires (1) the attacker to trick a logged-in WordPress user holding the upload_files capability (Author role or above) into clicking a specially crafted /wp-admin/media-upload link - this user interaction and privileged-victim requirement is the primary limiting factor; (2) the Pochipp plugin version ≤1.20.2 installed and active. The payload leverages the fact that sanitize_text_field() strips HTML tags but leaves double quotes intact, so a double-quote-based breakout of the value attribute in the heredoc-rendered search input is the specific technique. Because the flaw is reflected rather than stored, each victim must be individually lured; there is no persistence and no impact against non-privileged or non-authenticated sessions.

This is a genuine but modest-severity reflected XSS (CWE-79) carrying a vendor/Wordfence CVSS of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The network vector and low complexity are real, but the practical bar is meaningfully higher than the raw score suggests: exploitation is reflected (non-persistent) and requires social-engineering a victim who holds the upload_files capability (Author or above) into clicking a crafted /wp-admin/media-upload link. PR:N is technically correct because the attacker themselves is unauthenticated, but the payload only fires in the browser of an already-privileged logged-in user, so this is not a mass-exploitable, self-propagating flaw. No EPSS score, no CISA KEV listing, and no public PoC were provided in the intelligence, which is consistent with a low-to-moderate real-world exploitation likelihood - this is a patch-in-normal-cycle issue, not an emergency. The S:C (scope change) is defensible for XSS crossing from server output into the browser security context, though C:L/I:L accurately reflects that impact is limited to what a tricked Author-level session can do (session/action abuse within wp-admin), not confidentiality loss of the whole system. No signals conflict materially; the main caveat is that all severity data originates from a single source (Wordfence) with no independent EPSS/KEV corroboration.

An attacker crafts a malicious /wp-admin/media-upload URL with a JavaScript payload in the 'keyword' parameter (using double quotes to break out of the value attribute, since sanitize_text_field strips tags but preserves quotes) and sends it to a WordPress user with Author-or-higher privileges. When that user clicks the link while logged in, the unescaped value is reflected into the search input via a PHP heredoc and the script executes in their authenticated wp-admin session, letting the attacker perform actions or steal session context as that user. No public exploit code was identified at time of analysis, though the vulnerable source lines are referenced in the Wordfence/trac links.