CVE-2026-5748 is a stored cross-site scripting vulnerability in the Text Snippets WordPress plugin by snedled, affecting all versions up to and including 0.0.1. The issue arises from improper neutralization of input in the plugin's `ts` shortcode, allowing authenticated users with contributor-level permissions or higher to inject arbitrary JavaScript code. This code executes in the context of any user who views the injected page, potentially leading to session hijacking or other client-side attacks. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). No official fix or patch has been published by the vendor, and the plugin is not a cloud service, so remediation depends on plugin updates or manual mitigation.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of users who visit the infected pages, potentially leading to information disclosure (limited confidentiality impact) and integrity loss through script execution. Availability is not affected. The vulnerability requires authenticated access, reducing the attack surface. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only. Consider disabling or removing the Text Snippets plugin if it is not essential. Monitor for plugin updates that address this vulnerability and apply them promptly once available.