CVE-2026-1045 is a stored cross-site scripting vulnerability in the Viet contact plugin for WordPress, affecting all versions up to and including 1.3.2. The vulnerability arises from insufficient input sanitization and output escaping in the plugin's admin settings, enabling authenticated administrators to inject arbitrary web scripts. This vulnerability impacts multi-site WordPress installations or installations with unfiltered_html disabled, potentially allowing script execution in pages viewed by other users. The CVSS 3.1 base score is 4.4 (medium), reflecting network attack vector, high attack complexity, required privileges at the administrator level, no user interaction, and partial impact on confidentiality and integrity without availability impact. No known exploits are reported in the wild, and no patch or official fix has been documented.

An attacker with administrator-level permissions can exploit this vulnerability to inject malicious scripts that execute in the context of other users viewing the affected pages. This can lead to partial compromise of confidentiality and integrity of user data within the affected WordPress multi-site environment or installations with unfiltered_html disabled. There is no reported impact on availability. Since exploitation requires high privileges and no user interaction, the risk is limited to trusted administrators who may be malicious or compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider disabling or removing the Viet contact plugin in multi-site environments or where unfiltered_html is disabled. Monitor for updates from the vendor or WordPress plugin repository for any released patches or official mitigations.