CVE-2026-6439 is a stored cross-site scripting vulnerability in the VideoZen plugin for WordPress, affecting versions up to 1.0.1. The issue arises because the 'lang' POST parameter is stored directly via update_option() without sanitization and is later echoed inside a <textarea> element without applying proper escaping functions such as esc_textarea(). This flaw allows authenticated administrators or higher to inject arbitrary JavaScript into the plugin settings page, leading to script execution in the context of users who access that page. The vulnerability is categorized under CWE-79 and has a CVSS 3.1 base score of 4.4 (medium severity). No known exploits in the wild or vendor patches have been reported as of the published date.

An attacker with Administrator-level access or higher can inject and execute arbitrary JavaScript code within the plugin settings page. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed in the context of the affected users. The vulnerability does not affect availability. Since exploitation requires high privileges, the overall impact is medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Administrator-level access to trusted users only. Avoid accessing the plugin settings page from untrusted environments. Monitor for updates from the vendor regarding patches or official mitigations.