Supreme Modules Lite EUVD-2026-89940

Exploitation requires an authenticated account with at least Author-level (content-authoring) privileges on a WordPress site running the Supreme Modules Lite (Supreme Modules for Divi) plugin at version 2.5.63 or earlier, alongside the Divi theme/builder that the addon extends. It further requires victim user interaction (UI:R) - a second user, typically an administrator, must load the page or module containing the injected payload for the script to execute. Limiting factors: the need for a pre-existing privileged account, the required victim interaction, and dependence on the specific plugin being installed and active substantially narrow real-world exploitability. Note: the description's 'Author' wording suggests the true privilege bar may be PR:L rather than the vector's stated PR:H.

This is a high-CVSS-appearing but modest real-risk issue. The CVSS 3.1 base score of 5.9 (MEDIUM) is driven largely by the scope-change flag (S:C) and network vector, but the practical bar is high: the provided vector requires PR:H (privileged access) plus UI:R (a victim must be tricked into rendering the payload), and impact is capped at C:L/I:L/A:L. There is NO EPSS score, NO CISA KEV listing, and NO public POC in the provided data - exploitation status is 'no public exploit identified at time of analysis.' A notable conflict exists between the description and the vector: Patchstack labels this 'Author' XSS, and in WordPress an Author role typically maps to PR:L (a low-privileged contributor-tier account), yet the supplied vector uses PR:H. If PR:L is more accurate, the realistic score rises (roughly 6.5) but the vulnerability still requires an attacker to already hold a content-authoring account - this is an insider/compromised-account escalation vector, not a mass-exploitable pre-auth flaw. Bottom line: low-to-medium priority; verify the true privilege requirement with the vendor/Patchstack record.

An attacker holding an Author-level (content-authoring) account on the WordPress site injects a malicious JavaScript payload through a Supreme Modules Lite input field that is not properly sanitized. When another user - typically an administrator reviewing content - loads the affected page or module in the browser, the stored/reflected script executes in their session context (S:C), enabling session or limited data theft. No public exploit code is identified in the provided data, and successful exploitation depends on victim interaction (UI:R).