CVE-2026-1042 is a stored cross-site scripting vulnerability in the norcross WP Hello Bar WordPress plugin, affecting all versions up to and including 1.02. The vulnerability is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of the 'digit_one' and 'digit_two' parameters. Authenticated attackers with administrator privileges can inject arbitrary web scripts that execute in the context of users viewing the injected pages. This can lead to limited confidentiality and integrity impacts as reflected by the CVSS vector (AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N).

An attacker with administrator-level access can exploit this vulnerability to inject malicious scripts that execute in the browsers of users who visit the compromised pages. This may allow the attacker to steal sensitive information or perform actions on behalf of other users. The impact is limited to confidentiality and integrity with no availability impact. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to the 'digit_one' and 'digit_two' parameters. Avoid using the affected plugin version if possible or consider disabling the plugin until a fix is released.