CVE-2026-1854 is a stored cross-site scripting vulnerability in the Post Flagger plugin for WordPress, affecting all versions up to and including 1.1. The issue arises from improper neutralization of user-supplied input in the 'flag' shortcode, allowing authenticated users with contributor-level permissions or higher to inject arbitrary web scripts. These scripts persist and execute in the context of any user viewing the injected page, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting network attack vector, low attack complexity, required privileges of low (contributor), no user interaction, and partial impact on confidentiality and integrity. No patch or official remediation has been provided in the data, and no known exploits have been reported.

An authenticated attacker with contributor-level access or higher can inject persistent malicious scripts into pages via the 'flag' shortcode. This can lead to execution of arbitrary scripts in the context of other users viewing the affected pages, potentially compromising user data confidentiality and integrity. The vulnerability does not impact availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Post Flagger plugin if possible to prevent exploitation.