CVE-2026-2506 is a stored cross-site scripting vulnerability in the EM Cost Calculator WordPress plugin by motahar1. The issue arises from improper neutralization of input (CWE-79) where the 'customer_name' field is stored and later rendered in the admin interface without escaping. This allows unauthenticated attackers to inject arbitrary JavaScript that executes in the context of an administrator's browser upon viewing the EMCC Customers page. The vulnerability affects versions up to and including 2.3.1 and has a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the administrator's browser session, potentially leading to partial confidentiality and integrity loss of data accessible to the admin user. There is no direct impact on availability. The vulnerability requires the administrator to view the maliciously crafted customer list page for the script to execute.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid viewing untrusted customer data in the EM Cost Calculator plugin interface. Applying general WordPress security best practices, such as limiting admin access and using web application firewalls, may help reduce risk but do not directly mitigate this vulnerability.