CVE-2026-2280 is a stored Cross-Site Scripting vulnerability in the rexCrawler WordPress plugin by larsdrasmussen. It arises from improper neutralization of input during web page generation (CWE-79), allowing authenticated administrators to inject malicious scripts via the plugin's admin settings. The vulnerability affects all versions up to and including 1.0.15, specifically in multi-site WordPress environments or where unfiltered_html is disabled. The CVSS 3.1 base score is 4.8, reflecting a medium impact with network attack vector, low attack complexity, high privileges required, and user interaction needed. No patch or official remediation has been disclosed.

An attacker with administrator-level privileges can inject and store malicious scripts that execute in the context of users visiting the affected pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed on behalf of users. The vulnerability does not affect availability and requires high privileges and user interaction to exploit. It is limited to multi-site WordPress installations or those with unfiltered_html disabled.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider disabling or removing the rexCrawler plugin in multi-site environments or where unfiltered_html is disabled. Monitor vendor channels for updates and apply patches promptly once released.