CVE-2026-2719 is a stored cross-site scripting vulnerability (CWE-79) in the Private WP suite plugin for WordPress, affecting versions up to 0.4.1. The vulnerability is located in the 'Exceptions' setting, where insufficient input sanitization and output escaping allow authenticated administrators to inject arbitrary web scripts. These scripts execute upon page access, impacting multi-site WordPress installations or installations with unfiltered_html disabled. The CVSS 3.1 base score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, and requiring high privileges but no user interaction. No known exploits in the wild or vendor patches are currently documented.

An authenticated attacker with Administrator-level access can inject persistent malicious scripts into pages via the 'Exceptions' setting. These scripts execute in the context of users visiting the affected pages, potentially leading to session hijacking, privilege escalation, or other client-side impacts. The vulnerability is limited to multi-site WordPress environments or those with unfiltered_html disabled, reducing the scope of impact. There is no indication of impact on availability or system-level compromise.

No official patch or remediation is currently available for this vulnerability. Administrators should monitor the vendor's advisory channels for updates. As a temporary measure, restrict administrator access to trusted users only and consider disabling or limiting use of the 'Exceptions' setting in multi-site environments. Review and apply any future patches promptly once released.