CVE-2026-2834 is a stored cross-site scripting vulnerability in the Token of Trust Age Verification & Identity Verification WordPress plugin, affecting all versions up to and including 3.32.3. The issue is caused by improper neutralization of input in the 'description' parameter, enabling unauthenticated attackers to inject arbitrary web scripts that execute in the context of users visiting the injected pages. This can lead to impacts on confidentiality and integrity but does not affect availability. The vulnerability is publicly disclosed but lacks an official fix or patch as of the publication date.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of users accessing the affected pages, potentially leading to information disclosure and manipulation of user interactions. The CVSS score of 7.2 reflects a high impact on confidentiality and integrity with no impact on availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin to prevent exploitation. Implementing web application firewalls (WAFs) that detect and block XSS payloads may provide temporary mitigation. Avoid relying on generic mitigations unrelated to this specific vulnerability.