CVE-2026-39070: n/a

CVE-2026-39070 describes a stored cross-site scripting vulnerability in the Bit Assist WordPress plugin prior to version 1.7.2. The flaw resides in the Call-To-Action feature, allowing an attacker with administrative privileges to inject malicious scripts that can execute in the context of other users. This can lead to redirection to malicious websites or account control. The vulnerability requires authenticated access with high privileges and user interaction to exploit.

The vulnerability allows an attacker with admin privileges to perform stored XSS attacks, which can lead to user redirection to malicious sites and potential account compromise. The impact is limited by the requirement for high privilege (admin) and user interaction, resulting in a medium severity rating.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, limit administrative access to trusted users and monitor for suspicious activity related to the Call-To-Action feature.