CVE-2026-39071: n/a

CVE-2026-39071 describes a stored cross-site scripting vulnerability in the WordPress Spiffy Plugin prior to version 5.0.9. The flaw resides in the Event Title field, where an attacker with the lowest authenticated role (contributor) can inject malicious scripts. This can lead to user redirection to malicious websites or account control. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). No vendor advisory or patch information is available at this time.

An attacker with contributor-level access can exploit this vulnerability to execute arbitrary scripts in the context of other users, potentially redirecting them to malicious sites or hijacking their accounts. This compromises user trust and could lead to further attacks leveraging stolen credentials or session tokens. The impact is limited to confidentiality and integrity with no direct availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor privileges where possible and monitor for suspicious activity related to the Event Title field inputs.