ShortPixel Adaptive Images EUVD-2026-41342

Exploitation requires a valid WordPress subscriber-level account (confirmed by PR:L in the CVSS vector) - the attacker must be authenticated to the target WordPress instance. A second, higher-privileged user (typically an administrator) must visit a page that renders the attacker's injected content (UI:R). Limiting factors: sites where subscriber registration is closed require the attacker to obtain credentials through another means (phishing, credential stuffing); the vulnerability is not self-executing and cannot be triggered without a victim visit; and exposure is confined to installations running version 3.11.3 or below. Sites that restrict new user registration, enforce strong credential policies, and audit subscriber-tier access face meaningfully reduced realistic risk.

CVSS 6.5 Medium (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). The network attack vector and low attack complexity indicate the exploit mechanism is straightforward for any authenticated subscriber, but two friction factors meaningfully constrain mass exploitation: PR:L requires a valid WordPress account, and UI:R requires a separate victim (typically an admin) to load the page rendering the injected payload. The changed scope (S:C) is the primary risk amplifier - XSS executing in an admin session can enable unauthorized privilege escalation, plugin/theme modification, or credential theft well beyond what the individual C:L/I:L scores suggest. The A:L impact rating for an XSS vulnerability is atypical and may reflect plugin-specific behavior such as disrupting administrative image management workflows; this is inferred from the CVSS vector and not confirmed by a vendor statement. No EPSS data was provided for this CVE, precluding probabilistic exploitation comparison. No KEV listing and no public POC exist at time of analysis, suggesting opportunistic rather than targeted exploitation is unlikely in the near term. Sites with open subscriber registration and no WAF controls face the highest realistic exposure; sites where subscriber registration is closed face substantially lower risk.

An attacker registers a free subscriber account on a WordPress site running ShortPixel Adaptive Images <= 3.11.3 and submits a crafted XSS payload through a plugin-controlled input field, which is persisted without sanitization. When a site administrator subsequently visits the affected page or admin panel area rendering that content, the payload executes in their browser session. The attacker can then exfiltrate the admin's session cookie or silently perform administrative actions such as creating rogue admin accounts.