Content Egg EUVD-2026-89621

Requires an authenticated account with contributor-level role or higher on a WordPress site running Content Egg before 11.9.0, and specifically requires use of the bulk content-import feature with an import preset authored by a more privileged user. Exploitation is further gated by user interaction (UI:R): a victim - ideally an administrator - must later view the maliciously created post for the stored script to execute in their session. Impact is bounded by the privilege level of whoever views the content; the elevated C:H/I:H/A:H outcome depends on an administrator viewing the payload. Sites that do not grant contributor accounts to untrusted users are not realistically exposed.

This is a broken-access-control flaw in the bulk content-import feature that culminates in stored XSS, reported by WPScan and patched by the vendor in 11.9.0. The vendor CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H = 6.8) is internally inconsistent with the description in two respects worth flagging: (1) the description explicitly states 'contributor-level access and above,' which conventionally maps to PR:L, not the PR:H shown in the vector - this understates ease of exploitation; and (2) an XSS that executes 'in the context of anyone who later views that content' (i.e., in a more privileged user's browser session) is normally a scope change (S:C), yet the vendor marks S:U while simultaneously claiming C:H/I:H/A:H - total technical impact. The C:H/I:H/A:H is defensible only if the script executes in an administrator's session and is chained to full site takeover (create admin user, plant backdoor), which is a realistic outcome for admin-context WordPress XSS. Corroborating this, SSVC assigns Technical Impact: total. However, SSVC also records Exploitation: none and Automatable: no, there is no EPSS score, no CISA KEV listing, and no explicit public POC - so despite the 'total impact' framing this is a latent, not actively-exploited, issue. Net: a genuine account/privilege-boundary bug requiring a contributor foothold plus victim interaction, meriting prompt patching but not emergency response. Prioritize based on whether untrusted users hold contributor roles on the site.

An attacker who already holds a contributor (or higher) account on a WordPress site running Content Egg selects an import preset owned by a privileged user (e.g., an administrator) and runs the bulk content-import feature; the plugin fails to check that the contributor is authorized for that preset and switches to the preset author's identity, so the resulting post is created under the privileged account with the contributor's unfiltered script payload intact. When an administrator or other visitor later views the post, the stored JavaScript executes in their authenticated session, enabling actions up to and including site takeover. No public exploit code is identified at time of analysis, though WPScan holds the technical details.