Tangible Loops & Logic EUVD-2026-67459

The CVSS vector (PR:N/UI:N) indicates no authentication and no user interaction are required from the attacker's perspective. Exploitation requires that a vulnerable version of Tangible Loops & Logic is installed and active on a WordPress site, and that a template field, shortcode parameter, or content input processed by the plugin is reachable by unauthenticated users. If the XSS is stored, victim impact is automatic upon page load; if reflected, a victim must be directed to a crafted URL. The principal limiting factor is the plugin's deployment footprint - only sites explicitly using this plugin are vulnerable. There is no indication of default WordPress configurations introducing this exposure absent the plugin.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U) scores 6.5 but contains a notable anomaly: UI:N is atypical for XSS, which almost always requires a victim to load or interact with a page. S:U (unchanged scope) also conflicts with the cross-user nature of XSS, which by definition crosses a trust boundary into the victim's browser session. A more conventional rating for this class of vulnerability would be PR:N/UI:R/S:C, suggesting the provided vector may reflect a stored XSS scenario where the attacker's action (injection) requires no interaction, even if victim page load triggers execution. EPSS score is not provided, and the absence of KEV listing and public PoC reduces urgency. Real-world risk is moderate: the niche deployment footprint limits blast radius, but the lack of authentication and low complexity means any internet-facing WordPress site running this plugin is potentially exploitable without credentials.

An unauthenticated attacker identifies a Tangible Loops & Logic shortcode or template input field that accepts user-supplied content and reflects or stores it without encoding. The attacker submits a crafted payload containing a JavaScript snippet (e.g., a cookie-stealing script) via a public form or URL parameter. When an authenticated administrator or site visitor loads the affected page, the injected script executes in their browser, potentially exfiltrating session cookies or performing actions on their behalf.