CVE-2026-10104 is a stored cross-site scripting vulnerability in the Product Video Gallery for Woocommerce plugin for WordPress. The issue exists in the handling of the custom_thumbnail parameter, which lacks proper input sanitization and output escaping. This allows authenticated attackers with shop manager-level access or above to inject arbitrary web scripts into pages. These scripts execute in the context of users who access the injected pages, potentially leading to information disclosure or session hijacking. The vulnerability affects all plugin versions up to and including 1.5.1.8. The CVSS 3.1 base score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, and required privileges at the high level without user interaction.

An attacker with shop manager-level privileges or higher can inject persistent malicious scripts into pages via the custom_thumbnail parameter. These scripts execute in the browsers of users who visit the affected pages, potentially leading to limited confidentiality and integrity impacts such as theft of session tokens or modification of displayed content. There is no direct availability impact. The vulnerability requires authenticated access with elevated privileges and has a high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict shop manager-level access to trusted users only. Monitor for plugin updates from the vendor addressing this vulnerability and apply them promptly once released.