Virtue Toolkit CVE-2026-97266

Exploitation requires an authenticated account with at least Contributor privileges (PR:L) on a WordPress site running the Virtue/Ascend/Pinnacle Toolkit plugin version 4.9.12.1 or earlier, plus user interaction from a victim (UI:R) - typically a higher-privileged administrator or editor viewing the attacker-supplied content for the injected script to execute. Limiting factors: the flaw is not exploitable by unauthenticated visitors, depends on the specific (unspecified) plugin input field that lacks output encoding, and the payload only yields impact when a privileged user renders the malicious content. The specific vulnerable parameter and sink are not disclosed in the available data.

The single quantitative signal available is the reported CVSS 3.1 base score of 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), attributed to Patchstack. This is a network-vector, low-complexity flaw but is gated by two meaningful factors: it requires a low-privilege authenticated account (PR:L - a Contributor role, per the description) and victim user interaction (UI:R). The scope-change (S:C) with low tri-impact (C:L/I:L/A:L) is the standard Patchstack scoring pattern for stored/reflected XSS that executes in another user's browser context. No EPSS score, no CISA KEV listing, and no public proof-of-concept are present in the supplied data; no SSVC decision vector was provided either. Weighing these together, this is a low-to-moderate real-world priority rather than an urgent one: it is not remotely exploitable by an anonymous attacker, it needs a Contributor foothold plus an admin/editor to interact with the malicious content, and there is no evidence of exploitation. The primary value is that a compromised or malicious contributor could escalate influence via script execution in a higher-privileged session. No key signals are internally conflicting, but the absence of EPSS/POC data means exploitation likelihood cannot be quantified - treat as a routine patch-management item.

A user with Contributor-level access to a WordPress site running Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 submits content containing a malicious script payload through an input the plugin fails to sanitize. When an administrator or editor later views that content in the dashboard or on the rendered page, the script executes in their authenticated browser session, potentially enabling session hijacking or admin-context actions. No public proof-of-concept is identified in the available data, and the attack requires both the low-privilege account and victim interaction (UI:R).