WPComplete EUVD-2026-94929

Exploitation requires a victim who is an authenticated, privileged WordPress user (e.g., an administrator or user able to persist WPComplete data) to be tricked into visiting an attacker-controlled page or link while their session is active - this is the UI:R user-interaction requirement and the core limiting factor. The attacker needs no credentials of their own (PR:N) but cannot act without the victim's browser submitting the forged request; the flaw stems from missing or inadequate CSRF nonce/token validation on a WPComplete action that writes data later rendered without proper output encoding, enabling the stored XSS. Realistic risk is bounded by the need for social engineering of a logged-in privileged user and by the plugin being installed and active on the target WordPress site (versions up to and including 2.9.5.6).

This is a moderate-priority issue rather than a critical emergency. The CVSS 3.1 score of 7.1 (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects a network-reachable, low-complexity flaw requiring no attacker privileges but mandating victim user interaction (UI:R) - characteristic of a CSRF attack where a forged request must be triggered by a logged-in victim. The scope change (S:C) and low confidentiality/integrity/availability impacts are consistent with the stored-XSS payload executing in a different security context (the browser) than the vulnerable component. No EPSS score, KEV listing, POC, or SSVC decision data was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is gated by the UI:R requirement: an attacker cannot exploit this autonomously but must lure an authenticated/privileged WordPress user to a malicious page. The reliance on tricking a privileged user, combined with a niche plugin footprint, means this is a real but not widespread or automatable threat - prioritize patching for sites running WPComplete, but it does not warrant the same urgency as an unauthenticated, no-interaction RCE.

An attacker crafts a malicious web page or email containing a forged request targeting a WordPress site running WPComplete. When an authenticated administrator or privileged user visits that page while logged in, the browser automatically submits the forged request, causing a malicious script to be stored in the plugin's data. The stored XSS payload then executes whenever the affected content is rendered. No public exploit was identified at time of analysis.