CVE-2026-5070 is a stored cross-site scripting vulnerability in the siteorigin Vantage WordPress theme. The issue arises from improper neutralization of input during web page generation in the gallery template, allowing authenticated contributors or higher to inject malicious scripts via the Gallery block text content. These scripts execute in the context of users viewing the injected pages, potentially leading to information disclosure or session hijacking. The vulnerability is present in versions up to 1.20.32. No vendor advisory or patch information is currently available.

An attacker with contributor-level access or higher can inject malicious scripts that execute in the browsers of users who view the compromised pages. This can lead to limited confidentiality and integrity impacts such as theft of user session data or manipulation of page content. Availability is not affected. The vulnerability requires authentication but no user interaction beyond viewing the page. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider removing or disabling the vulnerable Gallery block if possible.