CVE-2026-1127 is a reflected cross-site scripting vulnerability in the Timeline Event History WordPress plugin by wpdiscover. The issue exists due to improper neutralization of input in the `id` parameter, allowing injection of malicious scripts that execute in the context of a user's browser when they click a crafted link. This affects all plugin versions up to 3.2. The vulnerability requires no privileges but does require user interaction (clicking a link). The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impacts.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to theft of sensitive information, session hijacking, or other client-side impacts. The vulnerability does not affect availability. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when clicking links related to the Timeline Event History plugin and consider disabling or removing the plugin if possible. Monitor the vendor's communications for updates on patches or official mitigations.