CVE-2026-11898 is a stored cross-site scripting vulnerability in the White Label CMS WordPress plugin (videousermanuals) that affects all versions up to and including 2.7.12. The vulnerability is due to improper neutralization of input during web page generation, allowing authenticated administrators to inject malicious scripts via admin settings. This vulnerability only affects multi-site WordPress installations or installations where the unfiltered_html capability is disabled. Exploitation requires high privileges and no user interaction. The CVSS 3.1 vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

An authenticated attacker with administrator-level permissions or higher can inject arbitrary web scripts into pages via admin settings. These scripts execute whenever a user accesses the injected page, potentially leading to session hijacking, defacement, or other script-based attacks. The vulnerability affects multi-site WordPress installations and those with unfiltered_html disabled, limiting the scope of impact. There is no indication of availability impact. The overall impact is rated as medium severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is indicated, administrators should monitor the vendor's communications for updates. Until a patch is available, restrict administrator access to trusted users only and consider disabling multi-site installations or enabling unfiltered_html if feasible to reduce exposure.