CVE-2026-0724 is a stored cross-site scripting vulnerability in the WPlyr Media Block WordPress plugin affecting all versions up to 1.3.0. The vulnerability exists due to improper neutralization of input during web page generation, specifically through the '_wplyr_accent_color' parameter. Authenticated attackers with administrator privileges can inject malicious scripts that execute in the context of other users viewing the compromised pages. This vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 4.4, reflecting medium severity with network attack vector, high attack complexity, and requiring high privileges but no user interaction.

An attacker with administrator-level access can inject persistent malicious scripts into pages via the vulnerable parameter. These scripts execute in the browsers of users who access the injected pages, potentially leading to unauthorized actions or data exposure within the context of the affected site. The impact is limited to confidentiality and integrity with no availability impact noted. The vulnerability requires high privileges to exploit and has a high attack complexity, reducing the likelihood of widespread exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider disabling or removing the WPlyr Media Block plugin if possible. Monitor official vendor channels for updates regarding patches or mitigations.