CVE-2026-85653: Contextual Related Posts <= 4.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'other_attributes' Block Parameter
The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'otherattributes' Block Parameter in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with Author-level access or higher can exploit it. The attacker must be able to supply a malicious value through the plugin's other_attributes block parameter.
Are sites using the default plugin configuration affected?
The available information does not state whether the vulnerable block parameter is exposed or usable in the default configuration. Affected versions are all Contextual Related Posts releases through 4.4.1.
What is the impact after successful exploitation?
An attacker can store arbitrary web script in an injected page. The script executes when another user accesses that page, potentially affecting the confidentiality and integrity of that user's session or browser context.
How can administrators determine whether they may be affected?
Check whether Contextual Related Posts is installed and identify its installed version; versions up to and including 4.4.1 are affected. Review content created or edited by Author-level and higher users for use of the plugin's block and unexpected other_attributes values.