CVE-2026-1805 is a stored cross-site scripting vulnerability in the DA Media GigList WordPress plugin (versions up to 1.9.0). The issue arises from improper neutralization of user-supplied input in the damedia_giglist shortcode, allowing authenticated users with contributor or higher privileges to inject arbitrary JavaScript code. This code executes in the context of users visiting the injected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). No known exploits in the wild have been reported, and no patch or official remediation has been disclosed.

An attacker with contributor-level or higher access can inject malicious scripts that execute in the browsers of users viewing the affected pages. This can lead to limited confidentiality and integrity impacts, such as theft of session tokens or manipulation of page content. Availability is not affected. The vulnerability requires authentication and low attack complexity but affects all users who access the injected content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the DA Media GigList plugin if possible to prevent exploitation.