Verge3D Publishing CVE-2026-92994

Exploitation requires the target site to run the Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 with its file storage/upload feature reachable. No authentication is needed (PR:N), but successful exploitation depends on a victim opening the attacker-uploaded file URL (UI:R) for the stored JavaScript to execute in their browser - so it is not a fully automatic drive-by. The core weakness is that the plugin neither validates uploaded file contents nor forces a safe content type, instead serving files with an attacker-controlled content type; installations on versions ≥4.13.1 are not affected.

This is a WPScan-reported (contact@wpscan.com / EUVD-2026-89622) unauthenticated stored XSS in the Verge3D Publishing and E-Commerce WordPress plugin (<4.13.1), where uploaded files are neither content-validated nor served with a safe content type, letting an attacker serve attacker-controlled JavaScript/HTML in the site origin. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8) is aggressive for an XSS: it assigns total (High) confidentiality, integrity and availability impact but keeps scope Unchanged, which is internally inconsistent with typical XSS scoring - script execution in a victim browser is normally a scope-changed, Low-impact event, so 8.8 likely overstates raw severity. Weighing the other signals in the same direction: SSVC records Exploitation=none, Automatable=no (Technical Impact=total), no EPSS score is provided, the CVE is NOT in CISA KEV, and no POC is indicated. No public exploit identified at time of analysis. Net: a genuine unauthenticated flaw worth patching, but the required victim interaction (UI:R), niche product footprint, non-automatable exploitation, and absence of exploitation evidence make this a moderate - not urgent - priority despite the 8.8 headline. Note the vector's C:H/I:H/A:H/S:U combination should be verified against the WPScan advisory.

An unauthenticated attacker uploads a file containing malicious JavaScript (or HTML) through the plugin's file storage feature, which stores it and later serves it back with an attacker-chosen content type. When any user - including an administrator - opens the URL to that file, the script executes in the context of the WordPress site, enabling session/cookie theft, admin action forgery, or redirection. No POC is publicly identified, and exploitation requires the victim to open the malicious file (UI:R).