CVE-2026-2277 is a reflected cross-site scripting vulnerability in the rexCrawler WordPress plugin by larsdrasmussen. It affects all versions up to and including 1.0.15. The issue occurs due to improper neutralization of input in the 'url' and 'regex' parameters on the search-pattern tester page, allowing injection of arbitrary web scripts. Exploitation requires an administrator to interact with a maliciously crafted link. This vulnerability specifically impacts multi-site WordPress installations or those where the unfiltered_html capability is disabled. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impact with no availability impact.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of an administrator's browser session, potentially leading to session hijacking, unauthorized actions, or information disclosure limited to the administrator's privileges. The impact is limited to multi-site or restricted HTML capability environments. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on untrusted links that could trigger this vulnerability. Consider restricting access to the search-pattern tester page or disabling the rexCrawler plugin if not needed. Monitor vendor channels for updates or patches addressing this issue.