Cool Formkit Lite EUVD-2026-89935

Exploitation requires an authenticated account with at least Contributor role on a WordPress site running Cool Formkit Lite ≤ 2.7.8 (PR:L), plus victim user interaction - a higher-privileged user must render the attacker-supplied content for the script to fire (UI:R). This limits exploitation to sites that (a) permit Contributor-level registration or otherwise grant such accounts, and (b) have privileged users who review or view attacker-controlled input. It is not exploitable by fully unauthenticated remote attackers and does not affect default configurations without a provisioned Contributor account.

This is a moderate, not high-priority, issue. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L → 6.5) describes a Contributor-authenticated stored/reflected XSS that requires (a) an attacker to already hold a low-privilege WordPress account with at least Contributor role and (b) a victim (typically an admin or editor) to view the malicious content (UI:R). The scope change (S:C) and split Low impacts across confidentiality, integrity, and availability are the standard Patchstack modeling for XSS that executes in another user's browser session. No EPSS score, no CISA KEV listing, and no public exploit code are provided, so there is no evidence of active exploitation or automation. The PR:L + UI:R combination substantially limits real-world risk: an attacker must first obtain a Contributor account on the target site, which is not the default for most WordPress installs and often not open to the public. This is a real but self-limiting defense-in-depth issue rather than an urgent, mass-exploitable flaw.

An attacker who has registered or been granted a Contributor account on a WordPress site running Cool Formkit Lite ≤ 2.7.8 injects a malicious script payload into a plugin-controlled field. When a higher-privileged user (e.g., an administrator reviewing pending content) opens the affected page, the script executes in their authenticated session, potentially enabling session/token theft or actions in the admin context. No public proof-of-concept is referenced.