CVE-2026-2986: The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the...
MEDIUM
CVSS 6.4
Exploit Available
1 PoC
Published: April 18, 2026 | Last Modified: April 18, 2026
Description
The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'other_attributes' parameter in versions up to, and including, 4.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Ghostwire Analysis — What This Means Practically
- Medium CVSS score indicates moderate risk — exploitation requires specific conditions or results in limited impact.
- 1 proof-of-concept exploit available on GitHub. Public exploit code lowers the barrier for both researchers and attackers.
- 3 articles from independent security sources have covered this vulnerability, indicating significant industry attention.
This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.
Proof-of-Concept Exploits (1)
Security Coverage (3 articles)
References