CVE-2026-4081 is a stored cross-site scripting vulnerability in the ZeM STL WordPress plugin caused by improper neutralization of input during web page generation (CWE-79). The plugin fails to sanitize and escape user-supplied shortcode attributes 'url', 'color', and 'bgcolor' before embedding them into HTML attributes. This allows authenticated attackers with Contributor-level privileges or higher to inject arbitrary JavaScript code that executes in the context of users visiting the compromised pages. The vulnerability affects all versions up to and including 1.0 of the plugin. No official patch or remediation has been documented yet.

An attacker with Contributor-level or higher access can inject malicious scripts via shortcode attributes, leading to stored cross-site scripting. This can result in the execution of arbitrary JavaScript in the browsers of users who view the infected pages, potentially compromising user sessions, stealing sensitive information, or performing actions on behalf of the victim. The vulnerability does not affect availability but impacts confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the ZeM STL plugin if possible. Monitor for updates from the vendor regarding patches or official mitigations.