CVE-2026-1903 is a stored cross-site scripting vulnerability in the Ravelry Designs Widget WordPress plugin (versions up to 1.0.0). It occurs due to improper neutralization of input in the 'layout' attribute of the 'sb_ravelry_designs' shortcode, allowing authenticated contributors or higher to inject arbitrary scripts that execute in users' browsers. The vulnerability is classified under CWE-79 and has a CVSS v3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), indicating network attack vector, low attack complexity, requiring privileges, no user interaction, scope changed, with low confidentiality and integrity impact, and no availability impact.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages using the vulnerable shortcode attribute. These scripts execute in the context of users visiting the affected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The impact affects confidentiality and integrity but does not affect availability. No known active exploitation has been reported.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. As a temporary mitigation, restrict contributor-level access to trusted users only and consider disabling or removing the Ravelry Designs Widget plugin until a fix is released. Review and sanitize any user-supplied input related to the 'layout' attribute manually if possible.