CVE-2026-0734 is a stored cross-site scripting vulnerability in the WP Allowed Hosts plugin for WordPress, affecting all versions up to 1.0.8. The issue stems from improper neutralization of input in the 'allowed-hosts' parameter, enabling authenticated administrators to inject malicious scripts that execute in the context of other users visiting the affected pages. This vulnerability is limited to multi-site installations or those with unfiltered_html disabled, requiring high privileges to exploit and no user interaction. The CVSS 3.1 vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, and impacts confidentiality and integrity with low severity impact.

An attacker with administrator-level access can inject persistent malicious scripts into pages via the vulnerable parameter. These scripts execute in the browsers of users who visit the injected pages, potentially leading to unauthorized actions or data disclosure within the affected WordPress multi-site environment. The impact is limited to confidentiality and integrity with no availability impact. Exploitation requires high privileges and is not known to be exploited in the wild.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is released, restrict administrator access to trusted users only and consider disabling or removing the WP Allowed Hosts plugin in multi-site environments or where unfiltered_html is disabled. Implementing additional web application firewall (WAF) rules to detect and block suspicious input may provide temporary mitigation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.