CVE-2026-1450 is a reflected cross-site scripting vulnerability in the rognone WordPress plugin (federicocarrara) affecting versions up to and including 0.6.2. The vulnerability is due to improper neutralization of input in the 'mode' parameter, allowing injection of arbitrary web scripts. This can be exploited by unauthenticated attackers who trick users into clicking malicious links, leading to script execution in the context of the affected site. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

Successful exploitation can lead to execution of attacker-controlled scripts in the context of the vulnerable website, potentially resulting in limited confidentiality and integrity impacts such as session hijacking or content manipulation. There is no impact on availability. The vulnerability requires user interaction and does not require authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the rognone plugin if feasible, or apply any recommended temporary mitigations from the vendor. Monitor official federicocarrara or WordPress plugin repositories for updates addressing this issue.