CVE-2026-1244 is a stored cross-site scripting vulnerability in the codeccoop Forms Bridge – Infinite integrations WordPress plugin. The issue is due to improper neutralization of input in the 'id' shortcode attribute within the 'financoop_campaign' shortcode, specifically in the forms_bridge_financoop_shortcode_error function. Authenticated attackers with Contributor-level privileges or above can exploit this to inject arbitrary web scripts that execute in the context of users visiting the compromised pages. The vulnerability affects all versions up to and including 4.2.5.

Successful exploitation allows an authenticated user with Contributor or higher privileges to inject and store malicious scripts in WordPress pages. These scripts execute in the browsers of users who visit the affected pages, potentially leading to session hijacking, privilege escalation, or other client-side attacks. The impact is limited to confidentiality and integrity of user interactions (C:L, I:L) and does not affect availability.

No official patch or fix is currently documented for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access and above to trusted users only. Consider disabling or removing the affected plugin if possible to prevent exploitation.