CVE-2026-10092 describes a stored cross-site scripting vulnerability in the Cincopa video and media plug-in for WordPress. The vulnerability exists because the plugin processes the [cincopa] shortcode via a comment_text filter hook without sufficient input sanitization or output escaping. This allows unauthenticated attackers who can submit comments to inject persistent malicious scripts into the database. When other users access pages containing these comments, the injected scripts execute in their browsers. The vulnerability affects all versions up to and including 1.163. The CVSS 3.1 base score is 7.2, indicating high severity. No patch or official remediation level has been provided by the vendor as of the published date.

An unauthenticated attacker able to post comments can inject malicious scripts that persist in the database and execute in the browsers of users viewing the affected pages. This can lead to partial confidentiality and integrity loss (e.g., theft of user session data or manipulation of page content). Availability is not impacted. The vulnerability affects all users who view the injected content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting or moderating comment submissions to prevent untrusted users from posting content with the [cincopa] shortcode. Additionally, review and apply any security controls that sanitize or filter comment content at the application or web server level.