CVE-2026-2719 is a stored cross-site scripting vulnerability (CWE-79) in the Private WP suite plugin for WordPress, specifically in the 'Exceptions' setting. The flaw exists due to improper neutralization of input during web page generation, allowing authenticated users with administrator privileges to inject arbitrary scripts. This vulnerability affects all versions up to and including 0.4.1, but only impacts multi-site WordPress installations or those where the unfiltered_html capability is disabled. The CVSS 3.1 base score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, and requiring high privileges without user interaction.

An authenticated attacker with administrator-level access can inject persistent malicious scripts into pages via the 'Exceptions' setting. These scripts execute in the context of users visiting the affected pages, potentially leading to information disclosure or session hijacking. The vulnerability does not affect single-site installations or those with unfiltered_html enabled. There are no known exploits in the wild at this time.

No official patch or fix is currently available for this vulnerability. Administrators should review the use of the 'Exceptions' setting in multi-site environments and consider restricting administrator access or disabling the plugin until a fix is released. Monitor the vendor advisory for updates regarding remediation. Since this vulnerability requires administrator privileges and specific configuration, limiting administrative access and carefully managing plugin usage can reduce risk.