CVE-2026-1261 is a stored cross-site scripting vulnerability in the MetForm Pro plugin for WordPress, specifically affecting the Quiz feature in all versions up to and including 3.9.6. The issue is caused by improper neutralization of input during web page generation (CWE-79), allowing unauthenticated attackers to inject arbitrary web scripts. These scripts execute in the context of users who visit the injected pages, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), indicating network exploitable, low attack complexity, no privileges or user interaction required, with impact on confidentiality and integrity but not availability.

Successful exploitation allows unauthenticated attackers to inject and execute arbitrary scripts in the context of users visiting the vulnerable pages, potentially leading to information disclosure and integrity compromise of user sessions or data. There is no indication of availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the Quiz feature or applying web application firewall (WAF) rules to detect and block malicious input targeting this vulnerability. Monitor vendor channels for updates and apply patches promptly once available.