CVE-2026-2289 is a stored cross-site scripting vulnerability in the Taskbuilder plugin for WordPress, affecting all versions up to 5.0.3. The vulnerability arises from improper neutralization of input during web page generation, allowing authenticated administrators to inject malicious scripts via admin settings. These scripts execute whenever a user views the compromised page. The vulnerability is limited to multi-site WordPress installations or those where the unfiltered_html capability is disabled, reducing the attack surface. The CVSS 3.1 vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, and partial impact on confidentiality and integrity.

An attacker with administrator-level permissions can inject malicious scripts that execute in the context of other users viewing the affected pages, potentially leading to partial confidentiality and integrity compromise. The vulnerability does not affect availability and requires high privileges and specific WordPress configurations (multi-site or unfiltered_html disabled). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — no official fix or patch links are provided. Users should monitor the vendor's advisory for updates. Until a patch is available, restrict administrator access to trusted users only and consider disabling or limiting the use of the Taskbuilder plugin in multi-site environments or where unfiltered_html is disabled. Avoid exposing admin settings pages to untrusted users. Review and sanitize inputs manually if possible.