CVE-2026-4085 is a stored cross-site scripting vulnerability in the maltathemes Easy Social Photos Gallery WordPress plugin (up to version 3.1.2). The issue arises from insufficient input sanitization on the 'wrapper_class' shortcode attribute in the 'my-instagram-feed' shortcode. The plugin uses sanitize_text_field() to process this attribute, which does not encode double quotes, enabling an attacker to break out of the HTML class attribute context and inject arbitrary HTML event handlers. This allows authenticated users with contributor-level permissions or higher to inject malicious scripts that execute in the context of any user viewing the compromised page.

An attacker with contributor-level or higher privileges can exploit this vulnerability to inject and execute arbitrary JavaScript in the context of users visiting the affected pages. This can lead to session hijacking, defacement, or other malicious actions limited to the scope of the injected script. The vulnerability does not affect availability and requires authenticated access, but it compromises confidentiality and integrity of user interactions with the site.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. As a temporary mitigation, restrict contributor-level access and above to trusted users only. Avoid using the vulnerable shortcode attribute until a fix is released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.