CVE-2026-1913 is a stored cross-site scripting vulnerability in the Gallagher Website Design WordPress plugin. The issue arises from insufficient input sanitization and output escaping of the 'prefix' attribute in the plugin's login_link shortcode. Authenticated attackers with Contributor-level privileges or higher can exploit this to inject arbitrary web scripts that execute in the context of users who access the compromised pages. This vulnerability affects all plugin versions up to 2.6.4. There is no vendor advisory or patch currently available, and no known exploits in the wild have been reported.

Successful exploitation allows authenticated users with Contributor-level access or above to inject malicious scripts that execute in other users' browsers when they visit the affected pages. This can lead to information disclosure and integrity impacts, such as theft of user credentials or session tokens. The vulnerability does not impact availability. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial confidentiality and integrity impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only. Consider disabling or removing the Gallagher Website Design plugin if possible to eliminate exposure. Monitor official channels for updates or patches from the vendor.