CVE-2026-1834 is a stored cross-site scripting vulnerability in the Ibtana – WordPress Website Builder plugin for WordPress. The flaw exists due to improper neutralization of script-related HTML tags (CWE-80) in the 'ive' shortcode, allowing authenticated contributors or higher to inject arbitrary web scripts. These scripts execute in the context of users visiting the compromised pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to and including 1.2.5.7. No known exploits in the wild have been reported, and no patch or official remediation details are currently available.

An attacker with contributor-level or higher access can exploit this vulnerability to inject malicious scripts that execute in the browsers of users viewing the affected pages. This can lead to unauthorized actions performed on behalf of users, data theft, or other client-side impacts typical of stored XSS vulnerabilities. The vulnerability does not affect availability but impacts confidentiality and integrity as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the 'ive' shortcode functionality if feasible to reduce exposure.