CVE-2026-6256 is a stored cross-site scripting vulnerability in the Credits Shortcode WordPress plugin by jashjacob. The flaw exists in the handling of the 'link' attribute within the 'credits' shortcode, where user input is not properly sanitized or escaped. Authenticated users with contributor-level permissions or higher can exploit this to inject arbitrary JavaScript code that executes in the context of other users viewing the page. This vulnerability affects all versions up to 1.2. The CVSS 3.1 base score is 6.4, reflecting a network attack vector with low attack complexity, requiring privileges, no user interaction, and impacts confidentiality and integrity with no availability impact. No patch or official fix has been published as of the data provided.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode attribute. This can lead to unauthorized actions performed in the context of other users, potentially exposing sensitive information or enabling further attacks. The impact is limited to confidentiality and integrity, with no direct availability impact. Since the vulnerability requires authenticated access, the attack surface is somewhat limited but still significant in environments where contributors are trusted users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should restrict contributor-level access to trusted users only and consider disabling or removing the Credits Shortcode plugin if it is not essential. Monitoring for unusual activity related to shortcode usage may help detect exploitation attempts.