As immediate action, update the affected plugin. If you're unable to do so, ask your hosting provider or web developer for help.
An Interactivity API binding could set a URL attribute to a javascript: value, which the client runtime applied without any protocol check. 7.1.4 filters bound URL attributes and refuses the protocol attribute on links.
While this vulnerability can be initiated by the role shown in "Required Privilege", successful exploitation requires a privileged user to perform an action — such as clicking a malicious link, visiting a crafted page, or submitting a form.
Attackers can inject malicious scripts into the site that steal visitor data or hijack their accounts.
CVSS score is a way to evaluate and rank reported vulnerabilities in a standardized and repeatable way but which is not ideal for WordPress.
This security issue has a low severity impact and is unlikely to be exploited.
Update to version 7.1.4 or later to resolve the vulnerability.
Published by Patchstack
28 Oct, 2026