WordPress Plugin Vulnerabilities

Narrative Publisher <= 1.0.7 - Contributor+ Stored XSS via narrative_post_script Post Meta

Description

The plugin does not restrict write access to a REST-exposed post meta field or escape it when rendering, allowing users with contributor-level access and above to store JavaScript that executes in the browser of any higher-privileged user who views the affected post.

Proof of Concept

Affects Plugins

Plugin icon
narrative-so
No known fix

References

CVE
CVE-2026-16273

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso
Submitter
Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso
Verified
Yes
WPVDB ID
c98113a9-ee8a-4a24-8b2f-d506b99bba1c

Timeline

Publicly Published
2026-07-21 (about 12 days ago)
Added
2026-07-21 (about 11 days ago)
Last Updated
2026-07-21 (about 11 days ago)

Other

Published
Title
Published
2025-10-27
Title
Consulting Elementor Widgets < 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-01-06
Title
Social Share Buttons for WordPress <= 2.7 - Admin+ Stored XSS
Published
2014-08-01
Title
timelineoptinpro - XSS
Published
2020-02-25
Title
Hero Maps Premium < 2.2.3 - Unauthenticated Reflected Cross-Site Scripting (XSS)
Published
2018-05-14
Title
GD bbPress Attachments <= 2.5 - Authenticated Stored XSS