CVE-2026-2722 is a stored cross-site scripting vulnerability (CWE-79) in the urkekg Stock Ticker WordPress plugin. It affects all versions up to 3.26.1 due to inadequate sanitization and escaping of input in admin settings. Authenticated administrators can inject malicious scripts that execute in the context of other users viewing the injected pages. This vulnerability is limited to multi-site WordPress installations or those with unfiltered_html disabled. The CVSS 3.1 base score is 4.8, indicating medium severity, with attack vector network, low attack complexity, high privileges required, and user interaction needed. No patch or vendor advisory is currently available.

Successful exploitation allows an authenticated administrator to inject persistent malicious scripts into pages, which execute when other users access those pages. This can lead to limited confidentiality and integrity impacts, such as theft of session tokens or manipulation of page content. Availability is not affected. The vulnerability is constrained by the need for high privileges and user interaction and only affects specific WordPress configurations (multi-site or unfiltered_html disabled). No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit administrator access to trusted users only and consider disabling or restricting use of the Stock Ticker plugin in multi-site or unfiltered_html-disabled environments. Monitor vendor channels for updates and apply patches promptly once available.