CVE-2026-1047 is a stored cross-site scripting vulnerability in the goback2 salavat counter Plugin for WordPress, affecting all versions up to 0.9.5. The issue is due to improper neutralization of input during web page generation, specifically through the 'image_url' parameter. Authenticated attackers with administrator-level privileges can inject arbitrary scripts that execute in the context of users visiting the injected pages. The CVSS 3.1 vector indicates the attack requires network access, high attack complexity, high privileges, no user interaction, and impacts confidentiality and integrity with a scope change.

Successful exploitation allows an authenticated administrator to inject malicious scripts that execute in the browsers of users visiting the affected pages. This can lead to unauthorized disclosure of information and modification of data within the context of the vulnerable WordPress site. The vulnerability does not impact availability and requires high privileges and no user interaction to exploit.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is released, restrict administrator access to trusted users only and consider disabling or removing the salavat counter Plugin if possible to prevent exploitation.