Vantage EUVD-2026-23172

Attacker must possess WordPress contributor-level access (or higher role) to create or edit pages containing gallery blocks. The vulnerability is triggered when a page with a gallery block containing injected script in the text/caption field is viewed by any user (no interaction required from the victim). Gallery blocks must be present and in use on the site; installations that do not use the gallery block feature or restrict page editing to administrators only are not exploitable. The Vantage theme version must be 1.20.32 or earlier; patched versions (1.20.33+) escape output correctly.

CVSS 6.4 (Medium-High) with network vector and low attack complexity reflects a legitimate threat: any authenticated contributor can inject persistent malicious scripts without user interaction. However, the attack is limited by authentication requirement (PR:L) and scope change (S:C), which bounds the impact compared to unauthenticated remote code execution. EPSS and KEV status are not provided in the input data, so exploitation prevalence cannot be assessed; however, as a stored XSS affecting a WordPress theme, the attack surface is substantial in multi-author WordPress environments where contributor access is common. The real-world risk is contingent on site configuration: single-author blogs with no contributor accounts face near-zero risk, while community-driven sites with many contributors or untrusted users face elevated risk. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C) accurately reflects that network attackers with low privileges can achieve stored script execution affecting other users, but no vulnerability in WordPress core or other critical systems is exposed by this alone. Priority should be elevated in WordPress installations where contributors are external parties or insufficiently vetted.

A WordPress site with multiple contributors (e.g., a news publication or community site) is targeted by an internal threat or compromise. The attacker logs in with a contributor account, creates a page with a gallery block, and injects JavaScript in the gallery caption that exfiltrates admin session cookies or redirects visitors to a phishing site. When site administrators or other users view the page, the injected script executes in their browser, enabling session hijacking or malware distribution.