CVE-2026-73344

This XSS in WP Data Access carries more risk than its CVSS 5.9 suggests. The vulnerability allows an Author to inject malicious scripts into plugin-specific data contexts—dashboard views and table renders that site Administrators routinely access. That's not merely a sanitization failure; it's a privilege escalation architecture. An Author injecting a payload into a data field the plugin manages can harvest admin session tokens when an Administrator opens that dashboard. The attack surface exists precisely because WP Data Access creates parallel data handling layers outside WordPress's standard post rendering pipeline, where core escaping functions like esc_html and wp_kses don't automatically apply. The pattern is not new. WordPress plugin security history shows that plugins building custom data interfaces consistently produce this class of vulnerability—the mismatch between WordPress's context-specific escaping APIs and plugin data layer requirements has generated CVE after CVE across fifteen years. This means the patch likely addresses the immediate injection point but may not restructure how the plugin renders Author-created data in Admin contexts. Check whether the fix closes the escalation path, not just the XSS. Prioritize remediation: the EPSS score (0.00172) reflects automated exploit difficulty, not the actual exposure window in production environments where plugin users are targeted specifically. Once public, this vulnerability exists as a documented escalation path for as long as the plugin remains unpatched—there's no enforcement mechanism in the plugin ecosystem forcing timely updates. Assume active targeting of unpatched installations within weeks of disclosure.

Reviewed through automated stages and approved by a human before publication.