The CVSS 6.5 rating for CVE-2026-73340 obscures the actual risk profile. While the base score correctly identifies that triggering the stored XSS requires a contributor-level account, this constraint is far more permissive than it appears—and the attack surface isn't as narrow as the medium rating suggests.
WordPress sites routinely maintain contributor accounts: multi-author blogs, community submission platforms, membership sites, and staging environments with external testers. A contributor with malicious intent doesn't need to publish anything. They create a draft post containing a crafted featured image URL, and then wait for an editor or admin to open that draft for review. At that point, the XSS executes in a high-privilege session context, potentially harvesting admin cookies, modifying content, or escalating further.
The CVSS captures the trigger mechanism but not the post-exploitation surface. Once that JavaScript fires in an admin context, the attacker gains access to the plugin ecosystem, theme editor, and user management—capabilities that can install new code, create rogue admin accounts, or rewrite the site's entire theme layer. This is a different risk category than "medium XSS in an image field."
The EPSS score of 0.00161 is misleading for this vulnerability class. Mass exploitation tools don't easily capture stored XSS gated behind contributor authentication. The metric reinforces the deprioritization that keeps this vulnerability pattern alive. Defenders relying solely on EPSS for prioritization will deprioritize precisely the vulnerabilities that require patience.
Updating to 5.3.4 is necessary but not sufficient. The critical question is whether the patch sanitizes at output time or only prevents new submissions—and whether existing posts containing malicious featured image URLs remain in your database. Any draft created during the vulnerable version window still contains an active payload awaiting the next admin who opens that post. Manual review of all drafts with featured images becomes mandatory for any site that had contributor access while running the vulnerable version. The cleanup question isn't a footnote; it's the actual perimeter.