CVE-2026-6256 is a stored cross-site scripting vulnerability in the Credits Shortcode WordPress plugin by jashjacob. The flaw exists in the handling of the 'link' attribute of the 'credits' shortcode, where user input is not properly sanitized or escaped before being rendered on web pages. This allows authenticated users with contributor or higher privileges to inject arbitrary JavaScript code that executes in the context of other users viewing the page. The vulnerability affects all versions up to 1.2. The CVSS v3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges. No official patch or remediation is currently documented.

An attacker with contributor-level access or higher can exploit this vulnerability to inject malicious scripts into pages using the 'credits' shortcode. This can lead to execution of arbitrary JavaScript in the browsers of users who visit the compromised pages, potentially resulting in session hijacking, defacement, or other client-side attacks. The vulnerability does not impact availability but compromises confidentiality and integrity to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Credits Shortcode plugin if not essential. Monitor for plugin updates from the vendor addressing this issue.