CVE-2026-18063 is a stored cross-site scripting vulnerability in the blueglassch Job Postings WordPress plugin. It occurs via the 'position_button' parameter due to improper neutralization of input during web page generation (CWE-79). Authenticated attackers with contributor-level privileges or above can inject arbitrary web scripts that execute in the context of users visiting the injected pages. The vulnerability affects all versions from 0 up to and including 2.8.1.

Successful exploitation allows an authenticated contributor or higher to inject malicious scripts that execute in the browsers of users viewing the affected pages. This can lead to limited confidentiality and integrity impacts such as theft of user session data or manipulation of page content. Availability is not impacted. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, privileges required, no user interaction, and partial confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict contributor-level access to trusted users only and consider additional input validation or output escaping controls if possible.