CVE-2026-3551 is a stored cross-site scripting vulnerability in the Custom New User Notification WordPress plugin (up to version 1.2.0). The issue stems from the plugin registering settings fields without sanitize callbacks and echoing values retrieved via get_option() directly into HTML input value attributes without proper escaping (esc_attr()). Affected fields include 'User Mail Subject', 'User From Name', 'User From Email', 'Admin Mail Subject', 'Admin From Name', and 'Admin From Email'. Authenticated users with administrator privileges can inject malicious scripts into these settings, which execute when the settings page is viewed. This can be leveraged in multi-site environments to target super administrators.

An authenticated attacker with administrator-level access can inject and execute arbitrary JavaScript in the plugin's settings page. This can lead to limited confidentiality and integrity impacts within the WordPress admin interface, such as session hijacking or unauthorized actions. The vulnerability does not affect availability. In multi-site setups, subsite administrators could exploit this to target super administrators, potentially escalating privileges or compromising site management.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and consider disabling or removing the plugin if possible. Monitor for updates from the plugin vendor or WordPress security channels for patches addressing this vulnerability.