EUVD-2026-89872
GHSA-8865-wrfx-gf8f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as subscriber
-
DeliveryInject XSS payload into oik input
-
ExploitVictim renders malicious content
-
ExecutionScript executes in victim browser
-
ImpactSession hijack or privileged action
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets WordPress sites running the oik plugin version 4.15.4 or earlier. The description's 'Subscriber' qualifier indicates a low-privilege authenticated subscriber account is the likely prerequisite (contradicting the vector's PR:N), so registration/authentication on the target site is a probable requirement. Exploitation further requires user interaction (UI:R) - a victim must render the injected payload for the script to execute. Limiting factors: niche plugin deployment, the need for a subscriber account (if the description is accurate), and reliance on victim interaction all narrow real-world exploitability beyond the raw 7.1 score. |
| Impact | The CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) rates this as HIGH, but several signals argue for a more measured priority. There is no EPSS score provided, no CISA KEV listing, and no public proof-of-concept - so this is no public exploit identified at time of analysis, not confirmed exploitation. Critically, there is a conflict in the source data: the vector encodes PR:N (unauthenticated) while the description explicitly labels this 'Subscriber Cross Site Scripting,' which implies a logged-in subscriber-level account is required (PR:L). This discrepancy should be verified with Patchstack/vendor, because it materially changes exploitability - a subscriber-gated XSS on a niche plugin is a substantially narrower threat than a fully unauthenticated one. The impact is also modest: partial confidentiality, integrity, and availability (C:L/I:L/A:L) with a scope change (S:C) reflecting script execution in the victim's browser context rather than server compromise, and exploitation requires user interaction (UI:R). Net: a real but lower-tier issue - patch in normal cycle rather than emergency, weighted down by the niche footprint of the oik plugin and the absence of any active-exploitation or POC signal. |
| Exploit ScenarioDerived | An attacker with (or who registers) a low-privilege subscriber account on a WordPress site running oik <= 4.15.4 injects a malicious script payload into a plugin-handled input field. When an administrator or other user views the affected page, the stored/reflected script executes in their browser session, enabling session-context actions such as cookie theft or admin-panel actions. No public POC is currently identified, and successful execution depends on the victim rendering the injected content (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Cross-site scripting in the oik plugin for WordPress (versions 4.15.4 and earlier) allows script injection that executes in a victim's browser session, with the Patchstack advisory scoping the issue to Subscriber-level users. The reported CVSS 3.1 vector scores 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), but the PR:N rating conflicts with the 'Subscriber' qualifier, which indicates a low-privilege authenticated account is the probable prerequisite, and exploitation additionally requires a victim to render the injected payload (UI:R). No public exploit code, no CISA KEV listing, and no confirmed patched release were identified at time of analysis, and the plugin's niche deployment combined with the authentication and interaction requirements keeps practical risk below what the raw 7.1 figure implies.
RemediationAI
No vendor-released patch version is identified in the available data; the provided reference set contains only the Patchstack advisory for the 4.15.4 release and no GitHub PR, commit, or tagged fix, so patched status is unconfirmed. The primary action is to track the Patchstack vulnerability page and the WordPress.org plugin repository for a release newer than 4.15.4 and upgrade immediately once one appears, or deactivate and delete the oik plugin if it is not actively used - the cleanest fix, with the side effect of losing any shortcodes or functionality it provides. While awaiting a fix, the most effective compensating control follows from the assessed PR:L prerequisite: disable open user registration and remove or restrict the Subscriber role on affected sites, or audit existing subscriber accounts, which breaks the likely entry point at the cost of preventing legitimate self-registration. Because exploitation requires the victim to render the injected content (UI:R), a web application firewall or reverse-proxy rule that strips script tags from request parameters and comments can help, at the cost of false positives on legitimate rich content. A strict Content-Security-Policy without unsafe-inline reduces script execution impact but commonly breaks theme and plugin inline JavaScript, so it should be tested before enforcement. Finally, keep admin and subscriber sessions short-lived and monitor for anomalous authenticated activity, since XSS in a logged-in session can be used to pivot beyond simple cookie theft.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a classic CWE-79 improper neutralization of input during web page generation (cross-site scripting) in a WordPress plugin. The oik plugin, published by bobbingwide, is a general-purpose utility/toolkit plugin that exposes shortcodes and administrative helpers; when attacker-controlled data reaches an HTML output context without escaping, an injected script tag executes in the context of the site's pages. The CPE entry cpe:2.3:a:bobbingwide:oik:*:*:*:*:*:*:*:* identifies the affected component as the oik plugin itself (wildcard version, matching all releases through the version named in the advisory), and the tags WordPress/XSS/Oik confirm this is a plugin-layer rather than core WordPress flaw. The CVSS vector's scope change (S:C) with low confidentiality, integrity, and availability impacts reflects that script executing in a logged-in user's session can act beyond the original security context - for example reading page content, performing actions as the victim, or stealing session material. The 'Subscriber' label in the advisory implies the injection point is reachable from the lowest default WordPress role, meaning an attacker would likely need to register or hold a subscriber account on the target site, which is what makes the vendor's PR:N vector and the description's privilege framing inconsistent; our independent assessment resolves that ambiguity toward PR:L.
Know when Oik gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Description labels this 'Subscriber' XSS implying a required low-privilege account (PR:L over the vector's PR:N); UI:R and S:C reflect victim-rendered script escaping to their browser context with limited C/I/A impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Subscriber Cross Site Scripting (XSS) in oik <= 4.15.4 versions.
Executive ViewAI
The oik plugin for WordPress (versions 4.15.4 and earlier) contains a cross-site scripting vulnerability (CVE-2026-96819) that could allow script injection in a victim's browser session, potentially compromising user accounts and site integrity for organizations using this plugin. Although rated HIGH (CVSS 7.1), exploitation requires user interaction, no public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis, reducing practical risk for most deployments. Leadership should prioritize monitoring for vendor patches and applying interim mitigations to protect affected WordPress sites.
Disable the oik plugin if not essential; apply WAF rules to block XSS payloads targeting the plugin; restrict and monitor Subscriber-level accounts; enforce least privilege and monitor for suspicious browser behavior.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
The oik plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes such as bw_contact
Cross-Site Request Forgery (CSRF) vulnerability in bobbingwide.12.0. Rated medium severity (CVSS 4.3), this vulnerabilit
Exploit-DB