Mdtf EUVD-2026-12009

The CVSS 6.5 score with network accessibility (AV:N), low attack complexity (AC:L), and low privilege requirements (PR:L) indicates a moderately exploitable vulnerability in typical deployments. However, the required user interaction (UI:R) and changed scope (S:C, affecting other security domains) moderate the immediate threat level. Without confirmed KEV status or public proof-of-concept availability, the real-world exploitation probability remains uncertain. The vulnerability is most dangerous in multi-user WordPress environments where authenticated users (contributors, editors) can inject payloads targeting site administrators or other users. Organizations relying on this plugin should prioritize patching, but this does not represent a critical zero-day threat requiring immediate emergency response if exploitation is not actively reported in the wild. The cross-scope impact (S:C) elevates concern slightly, as compromised sessions could affect site integrity and user data confidentiality.

An authenticated attacker with contributor-level access injects a malicious script payload into a metadata filter field or taxonomy filter parameter. When a site administrator or other user interacts with the filtered content in the WordPress dashboard—such as clicking a filter link or viewing a filtered taxonomy list—the DOM-based XSS payload executes in their browser context. The attacker's script silently harvests the admin's WordPress session cookie or nonce token, allowing the attacker to perform unauthorized actions such as creating backdoor user accounts, modifying content, or exfiltrating sensitive data. If a public proof-of-concept exists, script kiddies with basic WordPress access can trivially execute such attacks across vulnerable WordPress installations.