CVE-2026-4859 is a stored cross-site scripting vulnerability in the SP Blog Designer WordPress plugin (versions up to 1.0.0). It occurs due to improper neutralization of input in the 'design' attribute of the wpsbd_post_carousel shortcode, allowing authenticated users with Contributor-level access or higher to inject arbitrary web scripts. These scripts execute in the context of users viewing the injected pages, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, required privileges, no user interaction, scope change, and limited confidentiality and integrity impact without availability impact. No vendor patch or official fix is currently documented.

An attacker with Contributor-level or higher privileges can inject persistent malicious scripts into pages via the vulnerable shortcode attribute. This can lead to the execution of arbitrary scripts in the browsers of users who visit the compromised pages, potentially resulting in limited confidentiality and integrity impacts such as theft of session tokens or unauthorized actions performed on behalf of users. There is no direct impact on availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit Contributor-level access to trusted users only and consider disabling or removing the SP Blog Designer plugin if possible. Monitor for plugin updates from softpulseinfotech and apply them promptly once available.