CVE-2026-0691 is a stored Cross-Site Scripting vulnerability in the CM E-Mail Blacklist – Simple email filtering for safer registration WordPress plugin by creativemindssolutions. The vulnerability exists due to improper neutralization of input during web page generation, specifically via the 'black_email' parameter. Authenticated users with administrator-level privileges can inject arbitrary scripts that execute when other users access the affected pages. This vulnerability affects all versions up to and including 1.6.2, but only impacts multi-site WordPress installations or those where the unfiltered_html capability is disabled.

Successful exploitation allows an authenticated administrator to inject malicious scripts that execute in the context of users viewing the injected pages, potentially leading to session hijacking, privilege escalation, or other client-side attacks. The impact is limited to confidentiality and integrity with no direct availability impact. The vulnerability requires high privileges (administrator) and network access, reducing the likelihood of exploitation by lower-privileged users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only, and consider enabling unfiltered_html capability if feasible to mitigate the impact. Monitor for updates from creativemindssolutions regarding patches or official workarounds.