Retainful CVE-2026-97396

Requires an authenticated account with subscriber-level privileges or higher (PR:L) on a site running Retainful ≤1.0.10; the attacker injects arbitrary web script through the 'data' parameter handled by the plugin's REST API (RestApi.php), which fails to sanitize input and escape output. The stored payload fires only when a user subsequently accesses the injected page, so impact depends on a higher-privileged victim (e.g., an administrator) viewing that content. Key limiting factors: no unauthenticated path (a valid low-privilege login is mandatory), so sites that disable open user registration substantially reduce exposure; exploitation also depends on a victim loading the affected page.

This is a moderate-severity Stored XSS (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) that should be treated as a patch-soon issue rather than a drop-everything emergency. The CVSS vector confirms network attack vector, low complexity, and - critically - PR:L, meaning an attacker must hold at least a subscriber-level account; this is NOT an unauthenticated flaw. The scope-changed (S:C) rating reflects that injected script executes in the browser context of other users/admins who view the poisoned page, which is the real danger: privilege escalation via admin session theft or CSRF-style actions. No EPSS score was provided in the input, there is no CISA KEV listing, and no public exploit code was referenced - the only source is the Wordfence vulnerability advisory. Signals are internally consistent (authenticated, low-complexity, web-script injection) with no contradictions to flag, but the absence of EPSS data means widespread-exploitation probability cannot be quantified from the input. Net: a genuine but authentication-gated web vulnerability whose real-world risk is amplified on sites that allow open user registration and dampened on sites that restrict account creation.

An attacker registers or obtains a subscriber-level account on a WordPress site running Retainful ≤1.0.10, then sends a crafted value in the 'data' parameter to the plugin's REST API endpoint, storing a malicious script. When an administrator or other user later views the affected page, the script executes in their browser, enabling session/cookie theft or actions performed as the victim. No public exploit code was identified at time of analysis, and exploitation requires a valid low-privilege account.