CVE-2026-0743 is a stored cross-site scripting vulnerability in the WP Content Permission WordPress plugin (versions up to 1.2). It results from improper neutralization of input in the 'ohmem-message' parameter, enabling authenticated administrators to inject arbitrary web scripts that execute upon page access. The vulnerability requires high privileges (administrator or above) and does not involve user interaction to trigger the script execution. The CVSS 3.1 base score is 4.4, reflecting network attack vector, high attack complexity, high privileges required, no user interaction, and limited confidentiality and integrity impacts.

An attacker with administrator-level access can inject malicious scripts into pages via the vulnerable parameter. This can lead to limited confidentiality and integrity impacts, such as executing unauthorized scripts in the context of users viewing the injected pages. There is no reported impact on availability. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and consider monitoring for unusual administrator activity. Avoid using the vulnerable plugin version if possible.