Ortto WordPress Plugin EUVD-2026-112571

Exploitation requires an actor who can already modify the Ortto plugin's configuration (consistent with PR:H - typically a high-privilege WordPress user with access to the plugin's admin settings page), and it additionally requires that a WordPress administrator subsequently visit the impacted settings page (UI:R) for the stored payload to execute. These two prerequisites - pre-existing configuration-write privilege and victim-admin page visit - are the real limiters on this stored XSS; it is not a remote-unauthenticated flaw. Affected deployments are Ortto installations before version 1.0.25; updating to 1.0.25 is the fix stated by the vendor.

This is a genuinely low-to-moderate priority issue, consistent with its CVSS 4.8 (Medium) rating, and the available signals reinforce rather than contradict that. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N shows the decisive limiter is PR:H: the attacker must already be able to modify the plugin's configuration, which for a WordPress settings page normally means a high-privilege account. UI:R adds a second gate - an administrator must actually visit the affected settings page for the stored script to fire. The scope change (S:C) and C:L/I:L reflect that the payload executes in the admin's authenticated browser session rather than against the vulnerable component itself, but the impact is capped at Low for both confidentiality and integrity with no availability impact. On the exploitation side there is no CISA KEV listing, no EPSS probability supplied, and no public exploit or PoC reference in the input, so the exploitation status is 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_month,' not act_now or emergency, which aligns with a patch-on-normal-cycle posture. No SSVC decision framework values (automatable, technical impact, exploitation) were provided. The main caveat is interpretive: the description frames the actor as 'able to modify the plugin's configuration,' which is a meaningful privilege prerequisite that is only partially captured by PR:H - verify who in a given deployment actually holds that capability.

An attacker who already holds an account permitted to change the Ortto plugin's configuration saves a malicious JavaScript payload into an unescaped settings field. Later, a WordPress administrator opens the plugin's admin settings page, and the stored script executes in their authenticated session, potentially performing actions as that administrator. No public exploit code is identified in the available data, and the attack still depends on both the privilege to write settings and the admin subsequently viewing the page.