UiChemy EUVD-2026-111738

Exploitation requires an authenticated account with contributor-level privileges or above on the target WordPress site, used to submit a 'javascript:' payload through the UiChemy builder slot link URL parameter ('actions[save_builder][data][elements][...][settings][slot_{N}_link][url]'). The payload is stored but does not fire on page load; per the description it executes on click, so successful exploitation is limited by the need for a higher-privileged user (Editor or Administrator) to click the attacker-crafted link while reviewing or previewing the Contributor's post. Limiting factors: the attacker must already hold a contributor account (registration/approval must be possible), the UiChemy plugin (versions ≤5.3.0) must be installed and active, and a privileged reviewer must take the click action - reducing realistic impact relative to a load-triggered, unauthenticated stored XSS.

This is a moderate, not emergency, priority. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting a scope-changing stored XSS exploitable over the network by an authenticated, contributor-level account. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a low-privilege-but-not-unauthenticated stored XSS. There is no CISA KEV listing and no EPSS score provided, so there is no signal of active exploitation or statistically-modeled exploitation likelihood; exploitation status is therefore 'no public exploit identified at time of analysis'. The provided references are a Wordfence advisory, the WordPress plugin page, and WordPress.org trac source-code lines/changeset - these are code-location and advisory references, not a verified working exploit. A key conflict exists between the CVSS vector and the description: the vector encodes UI:N (no user interaction), but the description explicitly states the injected 'javascript:' payload fires on click, making exploitation contingent on a privileged Editor or Administrator clicking the attacker-crafted link while reviewing the Contributor's post - i.e., user interaction IS effectively required. This meaningfully lowers real-world risk below what the 6.4/UI:N vector suggests, because it depends on a social-engineering step against a higher-privileged reviewer rather than firing automatically on page load.

A contributor-level user crafts a post in which a UiChemy builder slot link URL is set to a 'javascript:' payload via the 'actions[save_builder][data][elements][...][settings][slot_{N}_link][url]' parameter, which is stored without sufficient sanitization/escaping. When an Editor or Administrator later reviews or previews the post and clicks the malicious link, the script executes in their authenticated session, potentially enabling account or site takeover actions. No public exploit code is identified; the available references are a Wordfence advisory and the plugin source/changeset, not a verified working exploit.