YITH Tab Manager CVE-2026-97292

Requires an authenticated WordPress account with at least Author-level privileges on a site running YITH WooCommerce Tab Manager <= 2.15.0 (a WooCommerce-dependent environment). The attacker uses the plugin's tab-management feature to persist a script payload. Exploitation is further gated by user interaction (UI:R): a separate victim - typically an administrator or another logged-in user - must subsequently view the page rendering the injected tab content for the stored payload to fire. Limiting factors: the Author role is a trusted, non-default-anonymous privilege level, so this is not remotely exploitable by unauthenticated attackers; realistic risk is confined to multi-author sites, insider abuse, or scenarios where an Author credential has been compromised.

This is a moderate-severity stored XSS (CWE-79) rated CVSS 6.5 via the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, reported by Patchstack. The PR:L component means exploitation requires an authenticated account - described as 'Author' role, a privileged content contributor - and UI:R means a victim (typically an admin or another user) must load the page hosting the injected payload. The scope change (S:C) reflects that script executes in the browser origin beyond the vulnerable component, which is why the low per-impact metrics (C/I/A:L) still aggregate to 6.5. On real-world signals this is not an urgent priority: no EPSS score, no CISA KEV listing, and no public exploit code are present in the input (no public exploit identified at time of analysis). The requirement for an authenticated Author-level account meaningfully raises the bar - an attacker must already have trusted publishing access, so this is more an insider/privilege-abuse or account-takeover-chaining risk than a mass-exploitable flaw. Overall a genuine but lower-tier issue: patch in routine cycles rather than emergency. Note the description gives no specific injected parameter or output sink, so the exact attack surface is inferred from the CWE and CVSS vector only.

An attacker holding an Author-level WordPress account (via legitimate access, a compromised credential, or a multi-author site) configures a WooCommerce product tab and injects a malicious script payload into a tab field that the plugin stores without adequate sanitization. When a site administrator or another user later views the affected tab in wp-admin or on the storefront, the stored script executes in their browser session (scope-changed), potentially enabling session/cookie theft or admin-context actions. No public proof-of-concept is available in the provided data.