Ultimate FAQ EUVD-2026-85477

Requires an authenticated WordPress account with at least Contributor-level privileges on a site running Ultimate FAQ (by Rustaurius) version 2.4.14 or earlier. Exploitation is further gated by user interaction (UI:R): a separate, typically higher-privileged user such as an administrator must view the attacker-supplied FAQ content for the stored script to execute. Limiting factors: the attacker must first acquire a Contributor role (self-registration or granted access), the target site must run a vulnerable version, and the payload only pays off when a privileged victim renders the content - reducing realistic impact below the raw network-vector score.

This is a moderate-priority, high-CVSS-but-low-real-urgency issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, 6.5 MEDIUM) reflects a network-reachable but authentication-gated flaw: PR:L means a valid WordPress Contributor account is required, and UI:R means an administrator or another user must load the malicious FAQ content in their browser for the stored XSS to fire. The scope change (S:C) is credited because Contributor-injected script executes in a higher-privileged admin's browser session, which is the meaningful escalation path here. No EPSS score, no CISA KEV listing, and no public POC were provided, placing this at 'no public exploit identified at time of analysis' - the exploitation signals do not indicate widespread or automated attack activity. The A:L (availability) impact is questionable for a stored XSS and likely overstated; a value closer to A:N (~6.4) is more defensible. Net: a real but conditional issue requiring an attacker to already hold a Contributor role, not a drop-everything emergency.

An attacker who has registered or obtained a low-privileged WordPress Contributor account submits FAQ content containing a malicious script payload through the Ultimate FAQ plugin. When an administrator or higher-privileged user later views that FAQ entry in the WordPress dashboard, the stored script executes in their authenticated browser session (scope change), potentially enabling session/token theft or admin-context actions. No public POC or exploit code was identified at the time of analysis.