CVE-2026-48885: WordPress HollerBox plugin <= 2.3.10.1 - Cross Site Scripting (XSS) vulnerability

Synopsis

A reflected or stored cross-site scripting (XSS) vulnerability exists in the HollerBox WordPress plugin at version 2.3.10.1 and earlier. The flaw is reachable over the network, requires no authentication, but does require a victim to interact with a crafted link or page, as indicated by the CVSS vector. Successful exploitation allows an attacker to inject and run arbitrary JavaScript in a victim's browser, enabling session hijacking, credential theft, or unauthorized actions performed on the victim's behalf. HarborGuard is currently tracking this advisory for patch availability, as no fix version has been published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, meaning an attacker can deliver a malicious payload to it without any local or physical access to the host.

• AuthenticationNot required

  No account or credentials are needed; the vulnerability is reachable by any unauthenticated user.

• Victim interactionRequired

  A victim must interact with attacker-controlled content, such as clicking a crafted link or visiting a page hosting the malicious payload, for the injected script to execute.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race condition, memory layout dependency, or special environmental state is required for the attack to succeed.

Blast Radius

• Injected JavaScript executes in the victim's browser under the origin of the WordPress site, allowing an attacker to read session cookies and authentication tokens.
• An attacker can perform actions on the victim's behalf inside the WordPress admin panel if the victim is a logged-in administrator, including creating accounts or modifying site content.
• The XSS payload can silently redirect the victim to attacker-controlled pages for phishing or further credential harvesting.
• The CVSS vector assigns low impact to availability (A:L), meaning the injected script can also disrupt or degrade the victim's current session or page state.