CVE-2026-1266 is a stored cross-site scripting vulnerability in the Postalicious plugin for WordPress, affecting all versions up to and including 3.0.1. The vulnerability arises from insufficient input sanitization and output escaping in the admin settings interface. Authenticated administrators can inject arbitrary web scripts that execute in the context of users viewing the injected pages. This vulnerability is limited to multi-site WordPress installations or those where the unfiltered_html capability is disabled, increasing the risk of persistent script injection across the site network.

An attacker with administrator-level access can exploit this vulnerability to inject malicious scripts that execute in the browsers of users accessing the affected pages. This can lead to unauthorized actions performed on behalf of users, data theft, or session hijacking. The impact is limited to confidentiality and integrity loss with no direct availability impact. The vulnerability requires high privileges and network access, reducing the likelihood of exploitation by lower-privileged users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and consider disabling or removing the Postalicious plugin in multi-site environments or where unfiltered_html is disabled. Monitor for updates from the vendor and apply patches promptly once available.