CVE-2026-1654 is a reflected cross-site scripting vulnerability in the Peter's Date Countdown WordPress plugin (versions up to 2.0.0). The issue stems from improper neutralization of input in the $_SERVER['PHP_SELF'] parameter, which is used during web page generation without adequate sanitization or escaping. This allows attackers to inject malicious scripts that execute in the context of the victim's browser when they click a crafted link. The vulnerability has a CVSS 3.1 score of 6.1, reflecting medium severity with network attack vector, low attack complexity, no privileges required, but requiring user interaction. There are no known exploits in the wild and no patch links or vendor advisories provided at this time.

Successful exploitation could lead to execution of arbitrary scripts in the context of the victim's browser, potentially resulting in information disclosure or session hijacking. The impact is limited to confidentiality and integrity with no availability impact. The attack requires user interaction and can be performed remotely without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected plugin version. Additionally, applying web application firewall (WAF) rules that detect and block reflected XSS attempts targeting the PHP_SELF parameter may reduce risk.