DoFollow Case by Case CVE-2026-95817

Exploitation requires the target site to run the DoFollow Case by Case plugin (version ≤3.6.0) with the public comment submission feature enabled, and the attacker injects the payload through the Comment Content field - no attacker authentication is needed (PR:N). The key LIMITING factor, explicit in the description, is comment moderation: a stored payload does not execute until an administrator approves the comment, so sites that auto-approve or weakly moderate comments are at materially higher risk than those enforcing manual review. Execution then occurs automatically for any subsequent visitor to the affected post (victim needs only to view the page), and impact is bounded to script execution in the browser context (C:L/I:L, no availability impact).

This is a genuine but moderate-priority issue rather than a critical emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) describes a network-reachable, low-complexity, unauthenticated stored XSS with a scope change, which accounts for the elevated score. However, no EPSS probability was provided, the CVE is NOT listed in CISA KEV, and no public proof-of-concept is referenced in the supplied intelligence - so there is no public exploit identified at time of analysis. The CVSS vector marks PR:N and UI:N, but the description itself establishes a significant real-world limiting factor the base score does not fully capture: comment moderation. An administrator must approve the malicious comment before the payload becomes live, meaning exploitation depends on a human workflow step and is not fully automatable. SSVC-style framing: exploitation status is 'none' (no KEV/POC), automatable is effectively 'no' (requires admin approval to publish), technical impact is 'partial' (C:L/I:L, no availability loss). Net: a legitimate flaw worth patching on a normal cycle, but the combination of no confirmed exploitation, no POC, a niche plugin footprint, and a required moderation step argues against treating it as an urgent, widely-exploited threat.

An unauthenticated attacker submits a blog comment on a post served by a site running DoFollow Case by Case (≤3.6.0), embedding a script payload in the comment content that is stored without adequate sanitization. The comment sits in the moderation queue appearing visually innocuous; once an administrator approves it, the stored script executes in the browser of every subsequent visitor to that post, enabling session/cookie theft or admin-targeted actions. No public exploit code is identified, and successful exploitation hinges on the comment passing manual moderation.