WP Meteor CVE-2026-96572

Requires the WP Meteor Website Speed Optimization Addon ≤3.4.18 installed and active with comments enabled and author names displayed on the affected product. The attacker places the payload in the comment author name field and does not need authentication (PR:N). The principal limiting factor is that the comment must pass WordPress's comment moderation queue and be approved before the author name is rendered - this is explicitly a display prerequisite, not a sanitization control, but it reduces exploitation reliability; sites that auto-approve comments or attackers already holding approved-commenter status bypass this barrier. Execution then occurs whenever any user views the injected page.

The input CVSS 3.1 score is 7.2 (High) with vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, indicating a network-reachable, low-complexity, unauthenticated stored XSS with changed scope (reflecting the client-side browser impact typical of XSS). The PR:N metric confirms no authentication is required to submit the payload. However, several key exploitation signals are MISSING from the input: no EPSS probability, no CISA KEV listing, and no POC indicator were provided, so exploitation status is 'no public exploit identified at time of analysis.' A significant tempering factor is that the payload (comment author name) must clear WordPress's comment moderation workflow before it is displayed - the description explicitly calls this a display prerequisite rather than a sanitization control, but in practice it still adds a real-world reliability barrier not reflected in the AC:L metric. Net assessment: this is a legitimate but moderate-priority issue - the unauthenticated network vector and stored persistence are concerning, yet the moderation gate and the limited (C:L/I:L, A:N) client-side impact mean it is not a drop-everything emergency absent evidence of active exploitation. Priority rises for high-traffic sites that auto-approve comments or where attackers already have an approved-commenter status.

An unauthenticated attacker submits a blog comment with a JavaScript payload embedded in the comment author name field. Once a moderator approves the comment (or on sites configured to auto-approve), the unsanitized author name is rendered on the page, and the script executes in the browser of every visitor who views it - enabling session token theft or actions in the context of a logged-in administrator. No public exploit code was identified in the provided intelligence.