CVE-2026-6236 is a stored cross-site scripting vulnerability in the Posts map WordPress plugin by lucdecri. The issue exists in all versions up to and including 0.1.3, where the 'name' shortcode attribute is not properly sanitized or escaped. This allows authenticated attackers with contributor or higher privileges to inject arbitrary web scripts into pages, which execute in the context of users who access those pages. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. The vulnerability impacts confidentiality and integrity but not availability.

An attacker with contributor-level or higher access can inject malicious scripts that execute in the browsers of users viewing the affected pages. This can lead to theft of sensitive information or unauthorized actions performed on behalf of users. The vulnerability does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been published as of now. Until a patch is available, restrict contributor-level access to trusted users and consider disabling the Posts map plugin if feasible.