CVE-2026-2721 is a stored cross-site scripting vulnerability in the pierrelannoy MailArchiver WordPress plugin affecting all versions up to 4.4.0. The issue stems from improper neutralization of input during web page generation (CWE-79), allowing authenticated administrators to inject arbitrary web scripts via admin settings. This vulnerability is limited to multi-site installations or sites with unfiltered_html disabled, where injected scripts execute upon page access by users. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) reflects network attack vector, low attack complexity, high privileges required, user interaction needed, scope change, and limited confidentiality and integrity impact without availability impact.

An authenticated attacker with administrator-level permissions can inject persistent malicious scripts into pages viewed by other users, potentially leading to limited confidentiality and integrity compromise within affected WordPress multi-site or restricted unfiltered_html environments. There is no known exploitation in the wild. The vulnerability does not affect single-site installations or those with unfiltered_html enabled. The impact does not extend to availability.

No official patch or fix is currently available for this vulnerability. Administrators should be aware of the risk in multi-site or unfiltered_html-disabled environments and restrict administrator access to trusted users only. Monitor vendor advisories for updates or patches. Since this is a stored XSS requiring administrator privileges and user interaction, limiting exposure reduces risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.