The vulnerability CVE-2025-26913 affects the AR For WordPress plugin by webandprint and is classified as a DOM-based cross-site scripting (XSS) issue. It arises from improper neutralization of input during web page generation, which can allow an attacker to execute arbitrary scripts in the context of the affected site. The vulnerability impacts versions up to 7.7. The CVSS v3.1 base score is 6.5, indicating a medium severity with network attack vector, low attack complexity, requiring privileges and user interaction, and impacts confidentiality, integrity, and availability to a limited extent.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected WordPress site, potentially leading to limited confidentiality, integrity, and availability impacts. The attack requires user interaction and some privileges, which limits the ease of exploitation. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting privileges for users and be cautious with untrusted input. Monitor vendor channels for updates regarding patches or official mitigations.