CVE-2026-10089 is a stored cross-site scripting vulnerability in the Insert Pages plugin for WordPress, affecting all versions up to and including 3.11.4. The vulnerability arises from insufficient output escaping of post custom field keys ($key) in the the_meta() function. While the custom field values are sanitized, the keys are directly interpolated into HTML and echoed without escaping, allowing authenticated attackers with author-level privileges or higher to inject arbitrary scripts. These scripts execute whenever a user accesses a page rendered with the vulnerable shortcode, potentially compromising user sessions or performing other malicious actions.

An attacker with author-level access or higher can inject persistent malicious scripts into pages via custom field keys. These scripts execute in the context of users viewing the injected pages, potentially leading to session hijacking, privilege escalation, or other client-side attacks. The vulnerability does not affect unauthenticated users directly but leverages authenticated user privileges to inject payloads.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. As a temporary mitigation, restrict author-level access to trusted users only and consider disabling the Insert Pages plugin until a fix is released. Avoid rendering pages with the vulnerable shortcode if possible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.