CVE-2026-0735 is a stored cross-site scripting vulnerability in the User Language Switch WordPress plugin, present in all versions up to and including 1.6.10. The vulnerability stems from improper neutralization of input in the 'tab_color_picker_language_switch' parameter, allowing authenticated administrators to inject arbitrary web scripts. This vulnerability affects multi-site WordPress installations or installations where 'unfiltered_html' is disabled, enabling persistent script injection that executes when users visit the compromised pages. The CVSS 3.1 base score is 4.4, indicating medium severity, with attack vector network, high attack complexity, and requiring high privileges without user interaction.

An attacker with administrator-level access can exploit this vulnerability to inject malicious scripts that execute in the context of other users visiting the affected pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or content manipulation. The vulnerability does not affect availability and requires high privileges and specific WordPress configurations (multi-site or disabled 'unfiltered_html'). No known active exploitation has been reported.

No official patch or fix is currently documented for this vulnerability. Users should monitor the vendor's advisory channels for updates. In the meantime, restrict administrator access to trusted users only and consider disabling or removing the User Language Switch plugin in multi-site environments or where 'unfiltered_html' is disabled until a fix is available. Review plugin usage and configurations to minimize exposure.