CVE-2026-4032

CVE-2026-4032 is a Stored Cross-Site Scripting (XSS) vulnerability in the CodeColorer WordPress plugin affecting versions up to 0.10.1. The flaw exists in the 'class' parameter of the 'cc' comment shortcode and stems from insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject malicious scripts that execute when users access affected pages, provided comments are enabled and guest comments are permitted on the target post. The vulnerability carries a CVSS 3.1 score of 6.1 (Medium severity) with a network-based attack vector requiring minimal complexity and user interaction. The attack has limited impact on confidentiality and integrity but no availability impact. The EPSS score of 0.00019 indicates relatively low predictive risk compared to the broader CVE landscape. There is currently no evidence of active exploitation, as the vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) database and remains inactive on threat intelligence hot lists. Community attention appears minimal based on available indicators, though the moderate CVSS score and ease of exploitation warrant timely patching, particularly for WordPress installations with public commenting enabled.