CVE-2026-1647 describes a reflected Cross-Site Scripting vulnerability in the Comment Genius plugin for WordPress, affecting all versions up to and including 1.2.5. The issue stems from improper neutralization of input in the $_SERVER['PHP_SELF'] parameter, which is used during web page generation without adequate sanitization or escaping. This flaw allows unauthenticated attackers to inject malicious scripts that execute in the context of users who interact with crafted URLs. The vulnerability has a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, scope changed, and low impact on confidentiality and integrity with no impact on availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, potentially resulting in information disclosure or manipulation of user interactions on affected sites. The vulnerability does not impact system availability and requires user interaction to trigger. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the Comment Genius plugin or applying manual input sanitization and output escaping if feasible. Additionally, educating users to avoid clicking suspicious links can reduce risk.