VOD Infomaniak EUVD-2026-109257

The VOD Infomaniak WordPress plugin (version 1.5.14 or earlier) must be installed and active, and an attacker must be able to store input that the plugin later renders without neutralization; the specific feature, field, or form used for injection is not described in the available sources. Exploitation requires user interaction (UI:R) - a victim must view the page containing the stored payload for the script to execute, which limits automated mass exploitation. The input's unauthenticated (PR:N) classification is not confirmed by the description; stored XSS of this type commonly requires at least a low-privilege authenticated role to plant the payload, and this should be verified against the Patchstack advisory.

This is a moderate-severity stored XSS (CVSS 7.1) in the Infomaniak VOD WordPress plugin, reported by Patchstack and assigned a 'this_week' priority by vuln.today. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) describes network-reachable, low-complexity exploitation with a scope change and required user interaction, which is consistent with stored XSS firing in a victim's browser. However, PR:N (unauthenticated) is worth scrutiny: Patchstack frequently scores stored XSS in plugins as requiring at least contributor/author privileges to inject the persistent payload, and the description does not state how or by whom the malicious input is stored - so the 'unauthenticated' reading should be verified with the vendor/Patchstack advisory. No EPSS score, no CISA KEV listing, and no verified public exploit were provided; the sole reference is the Patchstack vulnerability database entry, not working exploit code. Net assessment: a real but lower-tier issue - meaningful because XSS is easy to weaponize and the scope change can affect site administrators, but tempered by the niche plugin footprint, the need for victim interaction, and the only partial C/I impact. The A:L (availability) impact in the input is generous for a reflected payload-in-browser XSS and is likely overstated.

An attacker stores a malicious script through an input field that the VOD Infomaniak plugin renders without proper neutralization; the exact injection point is not described in the available sources. When a site user or administrator later views the page containing the stored payload (UI:R), the script executes in their browser session, potentially enabling session/cookie theft or actions performed as the victim. No verified public exploit code was identified at time of analysis.