CVE-2026-1098 is a stored cross-site scripting vulnerability in the CM CSS Columns WordPress plugin affecting all versions up to 1.2.1. The issue stems from improper neutralization of input in the 'tag' shortcode attribute, allowing authenticated users with Contributor or higher privileges to inject arbitrary JavaScript code. This code executes in the context of users visiting the compromised pages, potentially leading to session hijacking or other script-based attacks. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting a network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and impacts confidentiality and integrity with no availability impact. No known exploits in the wild have been reported, and no patch or vendor advisory is currently available.

An attacker with Contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode attribute. These scripts execute in the browsers of users who view the infected pages, potentially compromising user data confidentiality and integrity. The vulnerability does not affect availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the CM CSS Columns plugin if possible to prevent exploitation.