Unvalidated File Upload Enables Stored XSS in WordPress Plugin

The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content type, allowing unauthenticated attackers to store a file containing malicious JavaScript that executes in the browser of any user who opens it.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-92994 is a stored cross-site scripting (XSS) vulnerability in the Verge3D Publishing and E-Commerce WordPress plugin that allows unauthenticated attackers to upload malicious JavaScript files. The plugin fails to validate uploaded file contents and serves them back with attacker-controlled content types, enabling the execution of arbitrary code in the browsers of any user who accesses the file. This vulnerability affects all WordPress installations using the vulnerable plugin versions, particularly e-commerce sites that rely on Verge3D for product visualization or file management. With a CVSS score of 8.8, this represents a high-severity risk that can lead to session hijacking, credential theft, malware distribution, and complete compromise of user interactions on affected sites.

Casky's 323 matching skills map this vulnerability across MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance), enabling practitioners to detect both the initial exploitation phase and ongoing attacker activity. Claude AI's extended reasoning identifies the attack chain: reconnaissance to locate vulnerable plugin versions, malicious file upload execution (CWE-79 validation bypass), and payload delivery through Content-Type manipulation. Practitioners using Casky would observe findings flagged as suspicious file uploads with mismatched MIME types, execution of JavaScript from unexpected file storage endpoints, and browser-based exploitation indicators in user session logs. The platform correlates these signals to reveal the stored XSS pattern, distinguishing between legitimate file operations and malicious persistence mechanisms that allow attackers to compromise every user who interacts with the poisoned file.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-92994.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-92994

Casky has 323 skills that investigate the attack patterns behind CVE-2026-92994. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn