CVE-2026-2121 is a stored cross-site scripting vulnerability in the Weaver Show Posts plugin for WordPress, present in all versions up to 1.8.1. The flaw exists because the plugin does not properly sanitize or escape the 'add_class' parameter, which is user-supplied. Authenticated attackers with Administrator privileges can exploit this to inject arbitrary JavaScript that executes in the context of users viewing the affected pages. This vulnerability is especially relevant in multisite environments where Administrators do not have the unfiltered_html capability, increasing the risk of script injection and persistent XSS attacks.

Successful exploitation allows an authenticated Administrator-level user to inject malicious scripts that execute in other users' browsers when they view the affected pages. This can lead to information disclosure or session hijacking limited to the scope of the injected script. The vulnerability does not affect availability and requires high privileges and no user interaction. There are no known exploits in the wild at this time.

No official patch or fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict Administrator-level access to trusted users only, especially in multisite installations where unfiltered_html capability is restricted. Monitor vendor channels for updates and apply any official patches promptly once available.