CVE-2026-2718 is a stored cross-site scripting vulnerability in the Dealia – Request a Quote WordPress plugin affecting all versions up to 1.0.8. The root cause is improper output escaping: the plugin uses wp_kses() where esc_attr() is required for HTML attribute contexts in Gutenberg block attributes. This allows authenticated users with Contributor-level privileges or higher to inject arbitrary JavaScript that executes when the affected page is viewed. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.4 (medium severity). No patch or remediation details are currently available.

An attacker with Contributor-level access or higher can inject malicious scripts into pages via Gutenberg block attributes. These scripts execute in the context of users viewing the affected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability does not affect availability and requires low attack complexity with no user interaction needed beyond viewing the page.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only. Monitor for plugin updates from the vendor addressing this vulnerability and apply them promptly once released.