EUVD-2026-84272
GHSA-73p4-x7g3-p8jm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain author-level WordPress account
-
DeliveryInsert Contextual Related Posts block with payload in 'other_attributes'
-
ExploitStore unsanitized script in page
-
ExecutionVictim (e.g. admin) views injected page
-
PersistScript executes in victim browser session
-
ImpactSession hijack or privilege escalation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress account with author-level capabilities or above (PR:L) on a site running Contextual Related Posts version 4.4.1 or earlier. The specific injection vector is the 'other_attributes' parameter of the plugin's block, so the site must use the Gutenberg block editor with this plugin active. Exploitation limiting factors: the attacker cannot be anonymous - author-level access is a real barrier on well-managed single-author or tightly-controlled sites; the payload only executes when a victim subsequently views the injected page (UI:N for the attacker, but a victim visit is required for impact to materialize). |
| Impact | This is a stored XSS (CWE-79) in the Contextual Related Posts WordPress plugin, rated CVSS 6.4 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The signals are internally consistent: network vector, low complexity, but critically PR:L means an attacker must already hold author-level (or higher) access to a WordPress site - a meaningful gate that excludes anonymous internet-wide exploitation. UI:N reflects that the payload fires automatically when any visitor renders the injected page, and S:C captures the cross-context execution in the victim's browser session. Impact is limited to C:L/I:L (script execution, no A:N availability impact). No EPSS score, KEV listing, or public POC is present in the input, so exploitation status is: no public exploit identified at time of analysis. This is a moderate-severity, low-urgency issue rather than a critical priority - the author-level prerequisite substantially limits real-world risk to sites with untrusted or semi-trusted content contributors, though it remains relevant on multi-author blogs where privilege escalation to admin is the practical goal. The 'other_attributes' Block Parameter is the concrete injection point, sanitized in the referenced fix changeset. |
| Exploit ScenarioDerived | An attacker holding author-level access on a multi-author WordPress site inserts a Contextual Related Posts block and supplies a malicious payload via the 'other_attributes' block parameter, which is stored without sufficient sanitization. When any user - including an administrator - views the page, the script executes in their browser session, enabling session/cookie theft or actions that can pivot to full site takeover. No public POC is referenced, and exploitation requires the attacker to already possess a contributor account. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Stored cross-site scripting in the Contextual Related Posts WordPress plugin, affecting all versions up to and including 4.4.1, allows an authenticated user with author-level capabilities or above to inject arbitrary JavaScript into a page through the 'other_attributes' block parameter. The injected script is persisted and then executes in the browser of any visitor who later views the affected page, which is reflected in the CVSS 3.1 score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) where the scope change captures the impact spreading beyond the vulnerable component into the hosting site's origin. Exploitation is gated by the author-level account requirement and by the site using the Gutenberg block editor with the plugin active; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
RemediationAI
The primary fix is to update the Contextual Related Posts plugin to a version newer than 4.4.1 once the patched release is available, since 4.4.1 and everything below it is affected; the supplied data identifies the upstream fix as a Trac changeset (revision 3703115) but does not include a confirmed tagged release number, so administrators should verify the installed version after updating rather than assuming any specific build is safe. If an administrator cannot upgrade immediately, deactivating the plugin removes the 'other_attributes' rendering path and the exposure entirely, at the cost of losing related-post functionality; alternatively, restrict who can hold author-level and higher roles, since the prerequisite for exploitation is an authenticated account at author level or above, and audit existing posts and block content for injected script. Additional compensating measures include reviewing plugins that render user-supplied block attributes, deploying a WordPress security plugin or WAF rule that filters script payloads in block attributes, and enforcing a Content Security Policy that blocks inline script execution, though CSP will not repair already-persisted payloads and can break legitimate site functionality. Site owners should treat the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/1ee59a73-c449-462d-9ff0-b652be56b73b?source=cve and the changeset link as the authoritative references when confirming patch status.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), realized here as a stored/persistent XSS in a WordPress plugin rather than in WordPress core. The Contextual Related Posts plugin registers Gutenberg blocks and renders them on the front end; the 'other_attributes' block parameter is accepted and emitted without adequate input sanitization on save and without output escaping at render time, with the referenced source files (includes/frontend/blocks/class-blocks.php and includes/frontend/class-media-handler.php in tags 4.4.0 and 4.2.4) showing the rendering paths where attribute data flows into markup. Because WordPress block attributes and post content are stored in the database, the malicious payload survives across requests and is served to every subsequent viewer of the page, making this persistent rather than reflected XSS. The CVSS vector's S:C (Scope Changed) reflects that a flaw in the plugin can execute script in the security context of the broader WordPress site and its users' sessions, so a compromise can lead to session riding, credential/CSRF-token theft, or administrative actions if a privileged user views the page. The CPE cpe:2.3:a:ajay:contextual_related_posts:*:*:*:*:*:*:*:* with a wildcard version confirms the vendor (ajay) and that the advisory covers the plugin across its version range, not a single build.
Know when Contextual Related Posts gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Author-level account required so PR:L; stored payload fires without attacker interaction on victim page view (UI:N, S:C); limited script-execution impact gives C:L/I:L, no availability effect.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'other_attributes' Block Parameter in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Contextual Related Posts
View allThe Contextual Related Posts WordPress plugin before 3.3.1 does not validate and escape some of its block options before
SQL injection vulnerability in the Contextual Related Posts plugin before 1.8.10.2 for WordPress allows remote attackers
Cross-site request forgery (CSRF) vulnerability in the Contextual Related Posts plugin before 1.8.7 for WordPress allows
Stored Cross-Site Scripting in Contextual Related Posts plugin for WordPress (versions up to 4.2.1) allows authenticated
Contextual Related Posts versions before 4.2.2 contain an authorization bypass vulnerability that allows unauthenticated
Exploit-DB