Gloria Admin Panel CVE-2026-94158

Exploitation requires an authenticated administrator (or a user with access to the plugin's admin panel interface) to be socially engineered into clicking an attacker-crafted link containing the payload - this user interaction (UI:R) is the primary limiting factor. The flaw is reflected (non-persistent), so the payload must be delivered per-victim rather than stored, and it executes only in the context of the victim's authenticated session. The specific vulnerable parameter/endpoint is not named in the description; exploitation targets the Gloria Admin Panel plugin on WordPress installations running version 1.3 or earlier. No special non-default configuration is indicated, but the plugin must be installed and the victim must have an active session when the link is followed.

This is a reflected XSS flaw (CWE-79) in the bkninja 'Gloria Admin Panel' WordPress plugin, reported by Patchstack. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) indicates a network-reachable, low-complexity, unauthenticated attack that requires victim user interaction and crosses a security scope (browser context). No EPSS score was provided, the CVE is NOT on the CISA KEV list, and no public proof-of-concept is referenced - the only source is the Patchstack database entry. Weighing these signals together, the real-world priority is MODERATE-to-LOW rather than urgent: reflected XSS requires tricking a user (typically an authenticated admin, given it is an 'admin panel' plugin) into clicking a crafted link, so it is not self-propagating or mass-automatable. The CVSS A:L (availability) impact is atypical for reflected XSS and likely reflects Patchstack's conservative scoring rather than a genuine denial-of-service primitive - treat the availability signal with skepticism. No active exploitation or automation evidence exists to elevate this beyond a standard client-side injection issue.

An attacker crafts a malicious URL targeting a vulnerable parameter in the Gloria Admin Panel plugin and delivers it to a logged-in WordPress administrator via phishing or a planted link. When the admin clicks it, unsanitized input is reflected into the generated page and the attacker's JavaScript executes in the admin's browser session, enabling session/cookie theft or actions performed as the admin. No public exploit code was identified at time of analysis.