CVE-2026-0815 is a stored cross-site scripting vulnerability in the Category Image WordPress plugin by pankajanupam. The issue exists in all versions up to and including 2.0 due to improper neutralization of input in the 'tag-image' parameter. Authenticated attackers with Editor or higher privileges can inject arbitrary web scripts that execute in the context of users visiting the injected pages. The vulnerability has a CVSS 3.1 base score of 4.4, reflecting network attack vector, high attack complexity, high privileges required, no user interaction, and impacts on confidentiality and integrity with no availability impact.

Successful exploitation allows an attacker with Editor-level or higher access to inject persistent malicious scripts into pages, potentially leading to unauthorized actions or data exposure for users viewing those pages. The impact is limited to confidentiality and integrity with no direct availability impact. The vulnerability requires authenticated access with elevated privileges, reducing the likelihood of exploitation by lower-privileged users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Editor-level access to trusted users only and consider disabling or removing the Category Image plugin if possible. Monitor for updates from the vendor or plugin author regarding patches or mitigations.