Responsive Plus EUVD-2026-91953

Requires an authenticated account with contributor-level privileges or higher on the target WordPress site running Responsive Plus (Responsive Starter Templates) plugin version 3.5.3 or earlier; the attacker injects the payload through shortcode attributes processed by the plugin's customizer helper (helper.php), where input sanitization and output escaping are insufficient. Exploitation is LIMITED by: (1) the need for a contributor-or-above account, so sites that disable open registration and vet authors are largely protected; (2) the requirement that a victim subsequently loads the page containing the injected shortcode for the script to fire. The flaw does not affect default configurations against unauthenticated attackers.

This is a medium-severity stored XSS (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) that sits well below top-priority status when all signals are weighed together. The CVSS vector shows network reachability and low complexity, but critically requires PR:L - authenticated contributor-level access - which is the single largest limiting factor: sites that do not allow self-registration or that restrict contributor accounts face little exposure. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified. The CVE is NOT on the CISA KEV list and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. The scope-change flag (S:C) and low C/I impacts correctly reflect that XSS executes in the victim's browser rather than compromising the server directly. In short, this is a legitimate but moderate-priority issue, not a high-CVSS-but-low-real-risk mislabel nor an urgent actively-exploited threat - it warrants routine patching, prioritized higher on multi-author sites with untrusted contributors. Note: the discovery source (Wordfence) is confirmed, but no vendor advisory or fixed version is explicitly stated in the input, and EPSS is missing.

An attacker who holds or obtains a contributor-level account on a target WordPress site uses the Responsive Plus plugin's shortcode attributes to embed a malicious script. When any user - including an administrator - later views the page containing that shortcode, the injected JavaScript executes in their browser, enabling session theft or admin-action forgery. No public exploit code is identified at time of analysis, and exploitation requires an authenticated contributor account plus a victim viewing the injected content.