Starter Templates EUVD-2026-92326

Exploitation requires an authenticated WordPress account with at least low-level privileges (PR:L) capable of submitting content through the Starter Templates (astra-sites) plugin, plus a second user - typically an administrator or editor - who must subsequently view the stored malicious content for the payload to execute (UI:R). Limiting factors: the attacker needs a valid account on the target site (so sites that do not permit untrusted user registration or restrict low-privilege roles are far less exposed), the payload only fires upon victim rendering rather than automatically, and the affected code path is the Starter Templates plugin specifically (versions up to and including 4.7.7). This is not remote-unauthenticated; the account prerequisite meaningfully narrows the realistic attacker population.

This is a moderate-severity stored XSS (CVSS 6.5, CWE-79) that realistically warrants routine-but-not-emergency patching. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L shows network reach and low attack complexity, but two meaningful brakes: PR:L requires an authenticated (low-privileged) account, and UI:R requires a victim to view the injected content before the payload fires. The scope change (S:C) is consistent with stored XSS, where script injected by one user executes in another user's (often an administrator's) browser session, which is why confidentiality and integrity are rated. No EPSS score, CISA KEV entry, or public POC was provided in the input, so there is no evidence of active exploitation or weaponization. Net: a genuine but middling-priority issue - real-world risk hinges on how loosely the site grants contributor/author-level accounts, not on mass remote exploitation. The only intelligence source is a single Patchstack advisory; the fixed version is not stated in the input ('n/a through 4.7.7'), so the remediation target should be verified with the vendor/Patchstack before deployment.

A low-privileged authenticated user (e.g., a contributor or author on a multi-user WordPress site) submits a crafted payload through a Starter Templates input field that is stored without proper neutralization. When an administrator or other user later views that content in wp-admin or on a page, the stored JavaScript executes in their browser, enabling session/cookie theft or actions in the victim's context. No public exploit code was identified at time of analysis.