CVE-2026-1164 is a stored cross-site scripting vulnerability in the Easy Voice Mail plugin for WordPress, affecting all versions up to and including 1.2.5. The issue stems from improper neutralization of input in the 'message' parameter, allowing authenticated administrators to inject arbitrary web scripts that execute upon page access. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.1 (medium severity). No patch or official fix has been documented, and the plugin is not a cloud service, so remediation depends on vendor updates or user action.

An attacker with Administrator-level access can exploit this vulnerability to inject malicious scripts that execute in the context of users viewing the affected pages. This can lead to unauthorized actions such as session hijacking or defacement. The impact is limited to confidentiality and integrity with no direct availability impact. Since exploitation requires authenticated administrator privileges, the risk is somewhat mitigated by access controls. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider disabling or removing the Easy Voice Mail plugin if possible. Monitor for vendor updates addressing this vulnerability.