If you're running this WordPress plugin, the CVSS 5.3 score is misleading you. The vulnerability allows unauthenticated visitors to modify styling data for any post in your system—including drafts invisible to your editors and private posts restricted to authenticated users. This isn't a cosmetic issue. It's a complete bypass of WordPress's access control model for content.
The mechanism: the plugin uses wp_localize_script to emit security tokens to all frontend visitors. Any visitor can retrieve a valid nonce from the page source and use it to send AJAX requests that modify post metadata. The attack requires no authentication, targets any post by ID, and persists indefinitely—modified drafts remain modified until manually discovered.
This is the seventh documented instance since 2019 of the same wp_localize_script nonce leakage pattern enabling unauthorized content modification in WordPress plugins. The pattern consistently receives MEDIUM CVSS scores despite consistently demonstrating HIGH impact in practice.
The vulnerability becomes more severe if styling values render without escaping on the frontend—you may be looking at a stored XSS pathway rather than just content tampering. Treat this as a potential stored XSS until proven otherwise.
On the timeline: disclosure doesn't stop exploitation. The attack surface is now public knowledge. Patch deployment lag is where compounding risk lives. Assume active exploitation within days of disclosure.
The wp_localize_script pattern that enables this has been documented as dangerous for years. WordPress core doesn't flag it, and the plugin ecosystem treats it as infrastructure rather than known-bad. This won't be the last instance.