CVE-2026-5340 is a stored cross-site scripting vulnerability in the Fancy Image Show plugin for WordPress, affecting all versions up to 9.1. The flaw exists because the plugin does not properly sanitize or escape inputs provided through the 'fancy-img-show' shortcode, allowing authenticated users with contributor or higher privileges to inject arbitrary JavaScript code. This code executes in the context of users viewing the compromised pages, potentially leading to session hijacking or other script-based attacks. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of users who visit the infected pages, potentially leading to information disclosure such as session tokens or other user data. The vulnerability does not affect availability but impacts confidentiality and integrity to a limited extent.

No official patch or vendor advisory is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, it is recommended to restrict contributor-level access to trusted users only and consider disabling or removing the Fancy Image Show plugin if possible to prevent exploitation.