CVE-2026-2714 is a stored cross-site scripting vulnerability (CWE-79) in the Institute Management – Learning Management System WordPress plugin. The flaw exists in the 'Enquiry Form Title' setting due to inadequate input sanitization and output escaping, enabling authenticated users with administrator privileges to inject arbitrary web scripts. These scripts execute when any user accesses the affected pages. This vulnerability affects multi-site WordPress installations and installations where the unfiltered_html capability is disabled. The CVSS 3.1 base score is 4.4, reflecting network attack vector, high attack complexity, high privileges required, no user interaction, and partial impact on confidentiality and integrity.

An attacker with administrator-level access can inject persistent malicious scripts into pages via the 'Enquiry Form Title' setting. This can lead to unauthorized script execution in the context of users visiting the injected pages, potentially compromising user data confidentiality and integrity. The vulnerability does not affect availability. The impact is limited to environments with multi-site configurations or where unfiltered_html is disabled.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is released, restrict administrator access to trusted users only and consider disabling or limiting the use of the vulnerable plugin in multi-site or unfiltered_html-disabled environments. Avoid exposing affected pages to untrusted users. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.