CVE-2026-2986

CVE-2026-2986 is a Stored Cross-Site Scripting (XSS) vulnerability in the Contextual Related Posts WordPress plugin affecting versions up to 4.2.1. The flaw exists in the 'other_attributes' parameter where insufficient input sanitization and output escaping allows authenticated attackers with contributor-level access or higher to inject malicious scripts into pages. When users access these compromised pages, the injected scripts execute in their browsers, potentially compromising session integrity and enabling unauthorized actions. The vulnerability carries a CVSS 3.1 score of 6.4 (Medium severity) with a network-based attack vector requiring low complexity and valid user credentials but no user interaction. The attack has limited scope with low confidentiality and integrity impacts but no availability impact. The EPSS score of 0.0001 indicates this vulnerability is not yet widely exploited in the wild relative to other known vulnerabilities. There is no evidence of active exploitation or public exploit code availability at this time. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and remains inactive on the Hot List, suggesting minimal community attention and low immediate threat. Organizations using the Contextual Related Posts plugin should prioritize updating to version 4.2.2 or later to remediate this risk, particularly for instances with multiple contributor-level accounts.