Polylang CVE-2026-97279

Requires an authenticated WordPress account with at least Contributor privileges on a site running Polylang <= 3.8.9 (PR:L). Exploitation is not automatic: a higher-privileged victim (e.g., editor/administrator) must view the attacker-supplied content for the script to fire (UI:R). These two factors - a pre-existing trusted account plus required victim interaction - are the primary limiters and make mass, unauthenticated exploitation infeasible. No special non-default plugin configuration is indicated in the advisory.

This is a moderate-severity, low-real-risk issue rather than an urgent priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, base 6.5) describes a network-reachable but authenticated (PR:L) stored/contributor XSS that additionally requires victim interaction (UI:R). The scope change (S:C) - script executing in the context of another user/admin browser session - is what lifts an otherwise low-impact bug (C:L/I:L/A:L) into the medium band. No EPSS score, no CISA KEV listing, and no public POC were provided, so all exploitation signals point to 'no public exploit identified at time of analysis.' The requirement for a valid Contributor account (a non-trivial trust level) plus a victim clicking/viewing the malicious content substantially limits practical, at-scale exploitation. There are no conflicting signals in the data; the CVSS vector is internally consistent with a contributor-authored XSS. Net: track and patch on a normal cadence, not an emergency.

An attacker who has obtained (or been granted) a WordPress Contributor account on a site running Polylang <= 3.8.9 submits content or plugin input containing a malicious script payload that is not properly sanitized. When a higher-privileged user such as an editor or administrator later views that content in the dashboard, the script executes in their authenticated browser session (scope change), enabling session/action abuse. No public proof-of-concept was provided in the intelligence.