CVE-2026-2292 describes a stored cross-site scripting vulnerability (CWE-79) in the Morkva UA Shipping plugin for WordPress. The flaw arises from insufficient input sanitization and output escaping in admin settings, enabling authenticated administrators to inject arbitrary web scripts. These scripts execute when users visit the injected pages, potentially compromising user interactions. The vulnerability affects all versions up to and including 1.7.9 and is limited to multi-site WordPress installations or those where unfiltered_html is disabled. The CVSS 3.1 base score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, and required privileges.

An attacker with administrator-level permissions can exploit this vulnerability to inject malicious scripts into pages, which execute in the context of users viewing those pages. This could lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed on behalf of users. The vulnerability does not affect availability. The impact is constrained to environments with multi-site setups or disabled unfiltered_html capability, reducing the overall attack surface.

No official patch or fix is currently indicated for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is available, restrict administrator access to trusted users only and consider disabling or limiting the use of the Morkva UA Shipping plugin in multi-site environments or where unfiltered_html is disabled. Avoid granting administrator privileges unnecessarily. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.