CVE-2026-0681 is a stored cross-site scripting vulnerability in the Extended Random Number Generator plugin for WordPress. The flaw arises from improper neutralization of input during web page generation, allowing authenticated users with administrator privileges to inject arbitrary scripts via plugin settings. This vulnerability affects all versions up to and including 1.1 and is limited to multi-site installations or installations where unfiltered_html is disabled. The CVSS 3.1 base score is 4.4, reflecting a medium impact with network attack vector, high attack complexity, and requiring privileges but no user interaction.

An authenticated attacker with administrator-level access can inject malicious scripts that execute in the context of users visiting the affected pages. This can lead to limited confidentiality and integrity impacts such as session hijacking or unauthorized actions performed on behalf of users. The vulnerability does not affect availability and requires high privileges and specific WordPress configurations (multi-site or unfiltered_html disabled). There are no known exploits in the wild.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. As a temporary mitigation, restrict administrator access to trusted users only and consider disabling or avoiding use of the Extended Random Number Generator plugin in multi-site environments or where unfiltered_html is disabled until a fix is released.