CVE-2026-13042 describes a stored cross-site scripting vulnerability in the yo35 RPB Chessboard WordPress plugin affecting all versions up to 8.1.2. The vulnerability is caused by improper neutralization of input during web page generation, specifically in the handling of comment content. The plugin's comment_text filter synthesizes dangerous attribute-breaking HTML at render time, which bypasses WordPress's kses sanitization since the payload uses only allowed tags and attributes. This allows unauthenticated attackers to inject arbitrary web scripts that execute in the context of users viewing the injected pages.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the browsers of users who visit pages containing the injected comments. This can lead to information disclosure, session hijacking, or other client-side impacts. The vulnerability does not affect availability and requires no user interaction beyond viewing the affected page.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or restricting the use of the RPB Chessboard plugin or filtering comment inputs at a higher level. Monitor vendor channels for updates and apply patches promptly once released.