CVE-2026-39482

CVE-2026-39482 is a DOM-based cross-site scripting (XSS) vulnerability in the PublishPress Post Expirator WordPress plugin affecting versions 4.9.4 and earlier. The vulnerability stems from improper neutralization of user input during web page generation, allowing an attacker to inject malicious scripts. This is a client-side vulnerability that executes in users' browsers rather than on the server. The vulnerability carries a CVSS score of 6.5 (Medium severity) with a network-based attack vector requiring low complexity and user interaction. The attack requires authenticated access (PR:L), meaning the attacker must have at least user-level privileges. Successful exploitation could result in limited impacts to confidentiality, integrity, and availability, as well as circumvention of security boundaries through the scope change parameter. There is currently no indication of active exploitation in the wild, as evidenced by the vulnerability's absence from CISA's Known Exploited Vulnerabilities (KEV) catalog and its inactive status on threat intelligence hot lists. The EPSS score of 0.00034 indicates this vulnerability ranks in the lowest percentile for exploitation probability compared to all CVEs. Organizations should prioritize patching Post Expirator to versions above 4.9.4, though the immediate risk appears low based on current threat landscape data.