Facebook for WordPress EUVD-2026-53908

No authentication is required - the CVSS vector PR:N confirms unauthenticated exploitation, meaning any external actor who can reach the WordPress site over the network can attempt to trigger the vulnerability. The plugin must be installed and active on the target WordPress site; default WordPress installations without this plugin are not affected. The sole meaningful limiting condition is UI:R (user interaction required): a victim must visit a page or click a URL containing the attacker's crafted payload for the XSS to execute. This requirement limits fully automated mass exploitation and means attackers must combine the vulnerability with a social-engineering or delivery mechanism. Exploitation is not constrained by specific non-default configuration settings beyond plugin presence; the CVSS AC:L indicates no special timing, race condition, or complex server-side state is needed.

The CVSS 3.1 score of 7.1 (High) is driven by network reachability (AV:N), low attack complexity (AC:L), no required privileges (PR:N), and scope change (S:C), partially offset by the requirement for victim interaction (UI:R) and low per-dimension impact ratings (C:L/I:L/A:L). No EPSS probability data was supplied, preventing quantitative exploitation likelihood assessment. The vulnerability is not listed in CISA KEV, so active exploitation is not confirmed. The UI:R constraint means mass automated exploitation is not directly feasible - attackers must social-engineer victims, reducing immediate automatable risk compared to zero-interaction flaws. However, the plugin's deployment across a large number of commercial WordPress sites - many processing authenticated sessions, e-commerce checkouts, and ad-tracking cookies - means a successful per-victim compromise can yield high-value session tokens despite the low per-component impact scores. The unauthenticated entry point (PR:N) means any external actor can attempt to trigger the vulnerability without needing an account, which keeps operational attacker cost low.

An attacker identifies a target WordPress site running Facebook for WordPress ≤5.2.1 and constructs a URL containing a JavaScript payload in the vulnerable plugin parameter. The attacker delivers this URL to an authenticated site administrator or a logged-in customer via a phishing email or forum post; when the victim loads the URL, the payload executes in their browser under the site's origin, allowing the attacker to exfiltrate session cookies, perform actions on behalf of the victim, or redirect the browser to a credential-harvesting page. No public proof-of-concept exploit code was identified in the provided data, though the low complexity (AC:L) suggests independent exploitation is straightforward for any attacker with basic XSS knowledge.