CVE-2026-1451 describes a reflected cross-site scripting vulnerability in the rognone WordPress plugin (up to version 0.6.2) developed by federicocarrara. The flaw exists due to insufficient input sanitization and output escaping of the 'a' parameter, enabling attackers to inject arbitrary web scripts. This vulnerability requires user interaction (clicking a malicious link) and can lead to partial confidentiality and integrity impacts without affecting availability. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of the affected website for users who click on crafted links. This can lead to partial disclosure of information and modification of data within the user's session context. There is no impact on system availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the rognone plugin or applying custom input validation and output escaping as a temporary mitigation. Additionally, educating users to avoid clicking suspicious links can reduce risk.