CVE-2026-12560 is a stored Cross-Site Scripting vulnerability in the Editorial Rating – Product Review & Rating System WordPress plugin by wpqode. It occurs due to improper neutralization of input in the 'Link URL' field, where insufficient sanitization and escaping allow injection of arbitrary web scripts. The injected scripts are stored in post meta (_wpas_er_options) via update_post_meta, which bypasses WordPress's unfiltered_html capability restrictions. Only authenticated users with administrator-level privileges or higher can exploit this vulnerability. The CVSS 3.1 base score is 4.4 (medium severity), reflecting network attack vector, high attack complexity, high privileges required, no user interaction, and partial confidentiality and integrity impact.

An attacker with administrator-level access can inject malicious scripts that execute in the context of users viewing the affected pages. This can lead to partial confidentiality and integrity loss, such as stealing session tokens or modifying displayed content. The vulnerability does not affect availability and requires high privileges and network access. Because the payload is stored in post meta, the usual WordPress content filtering does not prevent exploitation, increasing risk for administrators.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only. Review and sanitize inputs to the 'Link URL' field manually if possible. Monitor plugin updates from wpqode for a security patch addressing this issue.