CVE-2026-5293 is a stored XSS vulnerability in the Diagnosis Generator WordPress plugin caused by inadequate authorization and input sanitization in the themeFunc() function. This function processes theme update requests without verifying user capabilities, allowing low-privileged authenticated users to inject arbitrary JavaScript into theme files. The vulnerability is exacerbated by the save() function's use of stripslashes(), which disables WordPress's default magic quotes protection. Exploitation results in persistent script injection that executes when pages with the diagnosis form shortcode are accessed.

An attacker with subscriber-level access or higher can inject malicious scripts into theme files, leading to persistent cross-site scripting attacks. This can compromise the confidentiality and integrity of user interactions on affected pages. The vulnerability does not affect availability and requires authentication, but the low privilege level needed increases risk.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is released, restrict plugin usage to trusted users only and consider removing or disabling the plugin if possible to prevent exploitation.