CVE-2026-4088 is a stored cross-site scripting vulnerability in the Switch CTA Box WordPress plugin caused by insufficient input sanitization and output escaping of user-supplied post meta values ('cta_box_button_link', 'cta_box_button_id', 'cta_box_button_text', and 'cta_box_description') within the 'wppw_cta_box' shortcode. The plugin reads these values from a user-specified post ID and directly injects them into HTML output without applying escaping functions such as esc_attr(), esc_url(), or esc_html(). This allows authenticated users with contributor-level privileges or higher to inject arbitrary JavaScript that executes in the context of users viewing the affected pages. The vulnerability affects all versions up to and including 1.1. No patch or official remediation has been published as of the data provided.

An attacker with contributor-level access or higher can exploit this vulnerability to inject persistent malicious scripts into pages using the vulnerable shortcode. This can lead to theft of user session data, defacement, or other actions performed in the context of users viewing the compromised page. The CVSS 3.1 base score of 6.4 reflects a medium severity impact with network attack vector, low attack complexity, and no user interaction required. Confidentiality and integrity impacts are low, and availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Switch CTA Box plugin if possible. Monitor for plugin updates that address this vulnerability and apply them promptly once released.