CVE-2026-1985

CVE-2026-1985 describes a Stored Cross-Site Scripting (XSS) vulnerability in the Press3D plugin for WordPress, affecting all versions up to and including 1.0.2. The flaw stems from insufficient sanitization of link URLs within the 3D Model Gutenberg block, allowing authenticated attackers with Author-level access or higher to inject malicious javascript: URLs. When a user clicks on the affected 3D model, the injected script executes, potentially leading to session hijacking or defacement. Rated with a CVSS score of 6.4 (Medium), this vulnerability has a low attack complexity and requires low privileges for exploitation. The potential impact includes limited confidentiality and integrity compromise. While the FAUCET Risk Score is 86/100, indicating a higher risk, its EPSS score is very low, suggesting a minimal likelihood of exploitation in the wild. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are also absent, indicating a lack of widespread attention or exploitation at this time.