CVE-2026-0739 is a stored cross-site scripting vulnerability (CWE-79) in the WMF Mobile Redirector WordPress plugin by webbu. The issue exists in all versions up to 1.2 due to improper neutralization of input during web page generation, specifically in the plugin settings interface. Authenticated administrators can inject malicious scripts that persist and execute in the context of users visiting the injected pages. The vulnerability has a CVSS 3.1 base score of 4.4, reflecting network attack vector, high attack complexity, high privileges required, no user interaction, and partial confidentiality and integrity impact with no availability impact.

An attacker with Administrator-level access can exploit this vulnerability to inject and execute arbitrary JavaScript in the context of users visiting affected pages. This can lead to partial confidentiality and integrity compromise, such as session hijacking or unauthorized actions performed on behalf of users. There is no direct impact on system availability. The vulnerability requires high privileges and has high attack complexity, limiting exploitation to trusted users with elevated access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Administrator-level access to trusted personnel only and consider disabling or removing the WMF Mobile Redirector plugin if not essential. Monitor for updates from the vendor or plugin maintainers regarding patches or mitigations.