CVE-2026-2424 is a stored cross-site scripting vulnerability in the Reward Video Ad for WordPress plugin. The flaw exists due to improper neutralization of input in admin settings fields, allowing authenticated administrators to inject arbitrary scripts. These scripts execute in the context of users viewing the injected pages, potentially leading to limited confidentiality and integrity impacts. The vulnerability affects all versions up to and including 1.6. The CVSS 3.1 base score is 4.4, reflecting network attack vector, high attack complexity, high privileges required, no user interaction, and partial impact on confidentiality and integrity.

An authenticated attacker with Administrator-level access can inject malicious scripts into plugin settings, which are then stored and executed in the context of users visiting affected pages. This can lead to limited confidentiality and integrity impacts, such as theft of session tokens or manipulation of page content. There is no impact on availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Administrator-level access to trusted users only and avoid entering untrusted data into the affected plugin settings fields. Monitor vendor channels for updates regarding patches or official mitigations.