This CVE presents as routine stored XSS with a low CVSS and negligible EPSS score, but the exploit pathway fundamentally breaks the typical threat model. The injection-to-execution chain runs backward through WordPress's role hierarchy rather than forward to end users. A Contributor cannot publish directly—but their unsanitized input passes through an Editor or Administrator during approval. That reviewer, trusting content they've personally curated, is far more likely to interact with an embedded element than a random visitor. The click requirement, typically a severity mitigator, here becomes a targeting mechanism that favors high-privilege victims.
The link attribute context matters critically. This isn't script content insertion but attribute injection—likely javascript: URI or event handler execution, which bypasses many Content Security Policy configurations that WordPress operators rely on. More importantly, CSP bypasses matter less when the payload doesn't need JavaScript at all: plain HTML injection can rewrite admin URLs or exfiltrate session tokens through image source attributes, and the reviewing Editor clicks without hesitation because they trust the content they curated.
The distribution amplifier is the Patterns Kit itself. Patterns are designed for reuse across posts and pages. A single malicious pattern approved by an Editor doesn't live in one submission—it replicates across every instance where that pattern is used. The Editor reviewing one post isn't exposing themselves to one payload; they're potentially approving a payload that spreads across your entire site.
The orphaned Contributor account is the threat vector nobody audits. When a Contributor leaves an organization, how many WordPress sites actually revoke their access within 24 hours? Within a week? Those forgotten accounts sit in your role hierarchy with legitimate access to the exact editorial workflow this CVE exploits. They don't need to compromise anything—they already have the keys. Security tooling alerts on anomalous Admin behavior, not Contributor activity, because Contributors are assumed to be low-stakes. That's the entropy layer.
The patch exists in version 1.0.3 and earlier is the vulnerable baseline. Your audit questions: Are Editors and Admins exposed to unfiltered Contributor submissions on the same interfaces where their elevated privileges make XSS maximally dangerous? Have you traced which specific link-output functions in Patterns Kit are failing to escape? And critically—have you audited your Contributor accounts against your active employee roster?