CVE-2026-65473: Nexcess Virtue/Ascend/Pinnacle Toolkit Contributor XSS

CVE-2026-65473 · Severity: medium · CVSS 6.5 · Published 2026-07-23

The Virtue/Ascend/Pinnacle Toolkit plugin for WordPress is vulnerable to a security flaw that allows users with 'Contributor' level access to inject malicious scripts into website pages. If a site administrator or visitor views the affected content, these scripts could execute, potentially leading to unauthorized redirects, the display of fraudulent advertisements, or the theft of session information. This risk is particularly relevant for sites that allow multiple users to draft or submit content.

Vendors: StellarWP.

Quick answers

Is CVE-2026-65473 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-65473 being exploited in the wild.
How severe is CVE-2026-65473?
Medium severity, with a CVSS score of 6.5, published 23 July 2026.
Which products and versions are affected?
StellarWP Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.
Is there a fix for CVE-2026-65473?
A patch was published on 2026-07-23: Version 4.9.12.1 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-65473 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-65473?
Check whether you run StellarWP Virtue/Ascend/Pinnacle Toolkit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Virtue/Ascend/Pinnacle Toolkit plugin for WordPress due to improper neutralization of input during web page generation (CWE-79). The flaw allows authenticated attackers with 'Contributor' level permissions or higher to inject arbitrary web scripts. These scripts are executed in the browser of any user (including administrators) who visits the page where the malicious payload is stored. Exploitation requires the attacker to have network access to the WordPress dashboard and necessitates some level of user interaction, such as a victim viewing the compromised post or page. The issue is resolved in version 4.9.12.1.

Affected products

  • Nexcess (Liquid Web / StellarWP) Virtue/Ascend/Pinnacle Toolkit <= 4.9.12

Timeline

  • 2026-07-14: disclosed: Reported by Ananda Dhakal via Patchstack
  • 2026-07-22: advisory: Patchstack published advisory
  • 2026-07-23: advisory: NVD published CVE record
  • 2026-07-23: patched: Version 4.9.12.1 released to address the vulnerability

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.