CVE-2026-16273 — Narrative Publisher <= 1.0.7 - Contributor+ Stored XSS via narrative_post_script Post Meta
The Narrative Publisher WordPress plugin through 1.0.7 does not restrict write access to a REST-exposed post meta field or escape it when rendering, allowing users with contribu…
Published: 2026-08-02 · CVSS: 4.6 · CVSS 3.1
The Narrative Publisher WordPress plugin through 1.0.7 does not restrict write access to a REST-exposed post meta field or escape it when rendering, allowing users with contributor-level access and above to store JavaScript that executes in the browser of any higher-privileged user who views the affected post.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7