CVE-2026-4353

VULNERABILITY OVERVIEW CVE-2026-4353 is a Stored Cross-Site Scripting (XSS) vulnerability in the CI HUB Connector plugin for WordPress affecting all versions up to and including 1.2.106. The flaw exists in the 'id' attribute of the cihub_metadata shortcode and results from insufficient input sanitization and output escaping, allowing attackers to inject malicious scripts into page content. SEVERITY ASSESSMENT The vulnerability carries a CVSS 3.1 score of 6.4 (Medium severity) with a network-based attack vector requiring low complexity and low-level privileges (Contributor access or above). While no user interaction is required for exploitation, the impact is limited to confidentiality and integrity with no availability impact. The attack has a changed scope, meaning the vulnerability can affect resources beyond its original scope. EXPLOITATION STATUS Currently, there is no evidence of active exploitation in the wild. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities (KEV) catalog and is marked as inactive on threat intelligence hot lists. The EPSS score of 0.0001 indicates minimal probability of exploitation in the coming 30 days. However, the relatively low barrier to entry (requiring only Contributor-level WordPress access) suggests that organizations should prioritize patching to prevent potential malicious insider threats or compromised user accounts from injecting persistent XSS payloads.