PostX CVE-2026-96840

Requires an authenticated Subscriber-level (or higher) account, so the site must have open user registration or allow attacker-controlled low-privilege accounts; the attacker sets a double-quote-bearing value in their display_name via /wp-admin/profile.php, relying on WordPress core's pre_user_display_name filter using ENT_NOQUOTES (encodes &, <, > but not double-quotes). Exploitation further requires the site to render the PostX Archive Title block, where display_name is output into the alt="" attribute at Archive_Title.php:144 without sufficient escaping. Limiting factors: authentication is needed (Subscriber), so it is not truly unauthenticated despite the stated PR:N; sites that disable registration or do not use the Archive Title block are not exploitable in this path.

This is a moderate-priority stored XSS (CWE-79) in a popular WordPress plugin, but the signals conflict in a way defenders must reconcile. The input CVSS of 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) encodes PR:N (unauthenticated), yet the description itself states the payload is stored by 'a Subscriber-level user' via /wp-admin/profile.php - meaning an authenticated Subscriber account is actually required. This is a direct contradiction: CVSS vector says unauthenticated but the described mechanism requires authentication, so the true privilege requirement is PR:L, not PR:N - verify with Wordfence. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The scope-change (S:C) and network vector are legitimate because the stored script executes in the browser of any visitor to the rendered archive page, crossing a trust boundary from a low-privileged user to other users/admins. Net assessment: a real but not emergency issue - exploitation depends on open user registration and use of the PostX Archive Title block, which lowers real-world risk below what the 7.2 base score alone suggests.

An attacker registers a free Subscriber account on a site where registration is open, then edits their profile at /wp-admin/profile.php to set a display_name containing a double-quote payload that WordPress's pre_user_display_name filter (ENT_NOQUOTES) fails to encode. When any visitor or administrator loads a page rendering the PostX Archive Title block, the stored payload breaks out of the alt="" attribute at Archive_Title.php:144 and executes arbitrary JavaScript in their session. No public exploit code is identified at time of analysis.