ThirstyAffiliates EUVD-2026-114598

Two concrete preconditions must both hold: (1) the target site must use a block theme (such as Twenty Twenty-Five) where the Comment Content block causes comment HTML to flow through render_block, triggering the plugin's transformer - classic (non-block) themes are not affected; and (2) the attacker must already have had at least one prior comment approved on the site, after which subsequent crafted comments submitted via the 'comment' parameter are auto-approved and rendered publicly. Limiting factors for defenders: sites on classic themes are not exploitable; the one-prior-approved-comment requirement adds a gating step outside pure drive-by exploitation; execution occurs passively when any user views the injected page (no victim click beyond page view).

This is a stored XSS (CWE-79) in the ThirstyAffiliates WordPress plugin (≤3.12.1) scored 7.2 by Wordfence with vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - network-reachable, unauthenticated (PR:N), with a scope change (S:C) reflecting script execution in other users' browser context. Despite the 'unauthenticated' CVSS framing, the real-world attack is materially gated: it ONLY works on block themes (e.g., Twenty Twenty-Five) where the Comment Content block routes comment HTML through render_block into the plugin's transformer, AND the attacker must already have had one comment approved so that later crafted comments auto-approve. These are genuine preconditions the CVSS AC:L metric does not capture, so I assess the attack complexity as higher than the input vector implies (see assessed vector). No EPSS score, no CISA KEV entry, and no public exploit were provided in the input; the vuln.today decision label is 'this_week' rather than act_now/emergency. Net: a credible, publicly-rendered stored XSS worth patching promptly, but not a mass-exploitable drive-by - the block-theme-plus-prior-approved-comment gating makes it closer to a targeted/conditional issue than a widespread unauthenticated worm. The S:C scope change meaningfully raises impact because injected script runs against any visitor, potentially including administrators viewing the page.

An attacker first submits an innocuous comment and gets it approved, which causes their subsequent comments to be auto-approved. They then post a comment containing a crafted script payload via the 'comment' parameter; on a site using a block theme, the Comment Content block renders the comment HTML through render_block, invoking the plugin's transformer and executing the injected script in the browser of every visitor - including administrators - who views the page. No public exploit was identified in the provided data; the attack vector is network-based with low attacker-side complexity but depends on the above site conditions.