Prenotazioni EUVD-2026-96735

Exploitation requires the Prenotazioni plugin (version ≤1.7.5) to be installed and active, and depends on the specific settings fields that are saved without authorisation/CSRF validation and rendered without output escaping. No valid authentication or account is needed to inject the payload (missing auth + CSRF checks on the settings-save handler), but execution requires user interaction (UI:R): a privileged administrator must open the page where the unescaped setting is output, or a visitor must view the affected front-end rendering. Limiting factors: the payload only fires on page view (no automatic execution), SSVC rates it non-automatable, and impact is scoped to whatever the victim's browser session can do (typically admin-session abuse rather than direct server compromise).

Signals are moderate and partly conflicting. The input CVSS of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) treats this as near-critical, but that rating assigns full High confidentiality/integrity/availability impact with an unchanged scope, which overstates a settings-based stored XSS: the executed script runs in the victim browser's security context, so a scope change with lower direct impact is more defensible - hence my independent reassessment lands around 6.1. The genuinely elevated factor is PR:N: because the save routine lacks authorisation and CSRF checks, an unauthenticated attacker can plant the payload, which is worse than a typical authenticated-contributor XSS. Offsetting this, UI:R means an administrator (or visitor) must load the affected page for the payload to fire, and SSVC rates Exploitation as 'none' and Automatable as 'no', indicating no observed active exploitation and no reliable mass-automation path, even though SSVC Technical Impact is 'total'. A public exploit exists (WPScan), raising the practical likelihood above a theoretical bug, but this is a POC, not confirmed in-the-wild use - KEV status is absent. Net: a real and worth-patching issue driven mainly by the unauthenticated write + CSRF gap, but not an emergency-tier internet-wide threat, and the 8.8 input score should be treated with caution.

An attacker crafts a page or request that, when triggered (e.g. via CSRF or direct unauthenticated POST), saves malicious JavaScript into the Prenotazioni plugin settings on a target WordPress site. Because the settings are later rendered without escaping, the script executes when an administrator opens the plugin/settings page or when a visitor views an affected front-end output, enabling session/cookie theft or admin-account takeover. A public proof-of-concept is available from WPScan, lowering the barrier to reproduction.