CVE-2026-12560 is a stored cross-site scripting vulnerability in the Editorial Rating – Product Review & Rating System WordPress plugin. The vulnerability exists because the plugin fails to properly sanitize and escape input in the 'Link URL' field, which is stored in post meta (_wpas_er_options) via update_post_meta. This allows authenticated attackers with administrator or higher privileges to inject arbitrary web scripts that execute when users access the injected pages. The WordPress unfiltered_html capability exemption does not apply here, meaning all administrators are affected regardless of their unfiltered_html status. The CVSS 3.1 score is 4.4 (medium severity) with network attack vector, high attack complexity, high privileges required, no user interaction, and impacts on confidentiality and integrity but not availability.

An attacker with administrator-level access can inject malicious scripts into pages via the 'Link URL' field, potentially leading to unauthorized actions or data exposure when other users view those pages. The vulnerability affects confidentiality and integrity but does not impact availability. Because the payload is stored in post meta rather than post content, usual WordPress content filtering does not prevent exploitation, increasing the risk for all administrators.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to the plugin. Avoid using the vulnerable 'Link URL' field for untrusted input. Follow vendor updates for an official patch or mitigation.