CVE-2026-0693 is a stored cross-site scripting vulnerability in the Allow HTML in Category Descriptions plugin for WordPress. The plugin disables the wp_kses_data output filter on term_description, link_description, link_notes, and user_description fields without checking user capabilities. This allows authenticated administrators or higher to inject arbitrary scripts into category descriptions. The vulnerability affects all versions up to and including 1.2.4 and is limited to multi-site setups or installations with unfiltered_html disabled. Exploitation results in script execution in the context of users viewing the compromised category descriptions.

An attacker with administrator-level privileges can inject malicious scripts into category descriptions, which execute in the browsers of users who view those descriptions. This can lead to limited confidentiality and integrity impacts (as per CVSS: partial disclosure and modification of data). There is no direct availability impact. The vulnerability requires high privileges to exploit and user interaction is not required. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and consider disabling or replacing the plugin in multi-site or unfiltered_html-disabled environments. Monitor official vendor channels for updates or patches addressing this vulnerability.