CVE-2026-2986Active Exploitation

MEDIUMCVSS 6.4 · MEDIUM

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'other_attributes' parameter in versions up to, and including, 4.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Back to dashboard

4.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-79

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Active exploitation appears in 1 classified signals
Patch or workaround signal is available
3 mentions across 2 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
Disclosure: 1 classified signal
Peaked 1d ago at 2 mentions (2026-04-18); latest day: 1
3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d

Signal classification3 categories

Active Exploitation

133.3%

Disclosure

133.3%

Patch

133.3%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-18	2	Active Exploitation1Disclosure1
2026-04-21	1	Patch1

Full discourse3 posts

CyberWolfGuard@CyberWolfGuard169d
Patch
WORDPRESS PLUGIN ALERT: Technical details and CVEs have been disclosed for several popular plugins. If you are running any of the following, your site is vulnerable: CVE-2026-4801 CVE-2026-2262 CVE-2026-2986 Update all plugins #WordPress #InfoSec #BugBounty #CyberAlert https://t.co/pTlTlOCdrs
Post summary
The tweet warns that specific CVEs affect popular WordPress plugins and urges users to update their plugins to mitigate the vulnerability.
0000066
10 followersView on X
VulDB 🛡@vuldb172d
Active Exploitation
Our CTI team identified a lot of activities targeting ajay Contextual Related Posts Plugin (CVE-2026-2986) https://vuldb.com/vuln/358195/cti
Post summary
The text reports that multiple exploitation activities were observed against CVE‑2026‑2986 in the ajay Contextual Related Posts Plugin, but lacks specific exploit or patch details.
0000074
2.1K followersView on X
CVE@CVEnew173d
Disclosure
CVE-2026-2986 The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'other_attributes' parameter in versions up to, and including, 4.… https://www.cve.org/CVERecord?id=CVE-2026-2986
Post summary
CVE-2026-2986 is a stored XSS vulnerability in the Contextual Related Posts WordPress plugin (versions up to 4) that was disclosed, with technical details provided but no evidence of exploitation, tools, or patches.
0000039
57.2K followersView on X

Explore more

Back to dashboard