Pixfort Core CVE-2026-96450

Exploitation requires an authenticated account with at least Contributor privileges on a WordPress site running pixfort Core before 4.3.3, plus subsequent user interaction (UI:R) from a higher-privileged user who views or moderates the attacker-supplied content, at which point the injected script executes in that victim's browser (scope change, S:C). Limiting factors: the Contributor authentication barrier means the attacker cannot be a fully anonymous outsider (sites that do not allow untrusted user registration at Contributor+ are largely insulated), and the required victim interaction makes exploitation dependent on an admin/editor rendering the malicious content rather than being automatic.

This is a genuine-but-low-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4 MEDIUM - which recomputes exactly to 5.4, so the vendor score is internally consistent) shows the two structural limiters typical of WordPress contributor-role XSS: PR:L means the attacker must already hold an authenticated Contributor (or higher) account, and UI:R means a victim - typically an admin or editor - must render the injected content. The scope change (S:C) reflects script executing in the victim's browser context against the site rather than only the plugin, but confidentiality and integrity impact are only Low and availability is None. No EPSS score, KEV listing, or POC is provided in the input, so by the precision rules this is 'no public exploit identified at time of analysis.' There is no SSVC data supplied. No signals conflict: the vector, the CWE-79 classification, and the Patchstack description all agree this is an authenticated stored/reflected XSS. This is a real-but-modest issue - patch in routine cycles - not an emergency; the authentication requirement plus required victim interaction keep real-world exploitation opportunistic and post-account-compromise rather than mass-exploitable.

An attacker who has registered or acquired a Contributor-level account on a WordPress site running pixfort Core below 4.3.3 submits a post or plugin element containing a malicious script payload in an inadequately sanitized field. When an administrator or editor previews or moderates that content, the script executes in their authenticated browser session, enabling actions such as creating a rogue admin or stealing session data. No public POC or exploit code is referenced in the available data.