CVE-2026-13726 is a reflected Cross-Site Scripting (CWE-79) vulnerability in the MPG WordPress plugin prior to version 4.1.8. The issue is caused by the plugin failing to sanitize and escape a parameter before reflecting it back in the HTTP response. This allows unauthenticated attackers to craft malicious requests that, when sent by a victim, execute arbitrary scripts in the victim's browser context. The vulnerability has a CVSS v3.1 base score of 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, potentially allowing theft of sensitive information, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability of the victim's interaction with the affected site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 4.1.8, upgrading to version 4.1.8 or later (if available) is recommended once confirmed. Until an official fix is released, avoid clicking on suspicious links that may exploit this vulnerability.