CVE-2026-1843 is a stored cross-site scripting vulnerability (CWE-79) in the Super Page Cache WordPress plugin, specifically in the Activity Log functionality. Due to inadequate input sanitization and output escaping, unauthenticated attackers can inject malicious scripts that persist and execute in the context of users accessing the injected pages. This vulnerability affects all versions up to and including 5.2.2. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity with scope change.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of users viewing the injected pages, potentially leading to data disclosure or manipulation within the affected site. There is no reported impact on availability. The vulnerability affects confidentiality and integrity of user data and site content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or restricting access to the Activity Log feature to prevent injection and execution of malicious scripts. Monitor official vendor channels for updates and patches addressing this vulnerability.