The Saitama Addon Pack WordPress plugin through version 1.0.8 fails to sanitize and escape specific post metadata values before outputting them. This flaw enables users with contributor-level permissions or above to inject stored Cross-Site Scripting payloads. When a higher-privileged user reviews the content containing these payloads, the malicious scripts execute in their browser context. This vulnerability is identified as CWE-79 and has been assigned CVE-2026-17010. There is no official remediation or patch currently documented.

Successful exploitation allows an attacker with contributor-level access to execute arbitrary scripts in the browsers of higher-privileged users who view the compromised content. This can lead to information disclosure and limited integrity impact within the context of the affected WordPress environment. There is no indication of availability impact or known active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider manual review of post metadata inputs. Avoid reviewing untrusted content with higher-privileged accounts where possible.