Icegram Express EUVD-2025-210828

Exploitation requires an account with the WordPress Administrator role or higher, as the vulnerable list description setting is accessible only to that privilege level. Triggering the XSS additionally requires a second victim user - likely also administrator-level - to load the affected Icegram Express settings page in their browser, satisfying the UI:R CVSS requirement. The Icegram Express plugin must be installed and active on the target WordPress site. No non-default server configuration, network positioning, or protocol-level prerequisite is required beyond administrator-level WordPress authentication.

The CVSS base score of 3.5 (Low) accurately characterizes the constrained real-world risk. The PR:H metric confirms that an attacker must already hold WordPress Administrator-level credentials before the XSS payload can be planted, which is a substantial precondition in well-managed environments. The UI:R requirement further demands that a second victim user load the affected page for the payload to fire, adding another exploitation barrier. The publicly available PoC via WPScan raises some concern, but even a mid-sized municipal IT team in mielec would rightly deprioritize this issue behind unauthenticated or lower-privilege vulnerabilities affecting the same platform. The vulnerability is most relevant in multi-administrator WordPress deployments where a compromised or rogue admin account could leverage the stored XSS to pivot laterally to other privileged sessions. EPSS data and KEV status are absent from the provided input, so automated exploitation probability and confirmed active exploitation cannot be assessed; no public exploit identified at time of analysis beyond the WPScan-documented PoC.

An attacker who obtains WordPress Administrator credentials - via phishing, credential stuffing, or a prior compromise - navigates to the Icegram Express list settings and inserts a JavaScript payload into the list description field. The payload is stored in the database and executes in the browser of any administrator or privileged user who subsequently loads the affected settings page, enabling session token theft or ghost actions under their identity. A public proof-of-concept is available via the WPScan entry.