CVE-2026-6447 is a stored cross-site scripting vulnerability in the Call for Price for WooCommerce plugin for WordPress, present in all versions up to 4.2.0. The issue arises from insufficient input sanitization and output escaping in the plugin's admin settings interface. Authenticated attackers with administrator privileges can inject arbitrary web scripts that execute when users visit the affected pages. This vulnerability impacts multi-site WordPress installations or those with unfiltered_html disabled, limiting the scope of exploitation. No official patch or remediation guidance is currently available from the vendor.

Successful exploitation allows an attacker with admin-level access to inject and execute arbitrary scripts in the context of affected WordPress sites. This can lead to limited confidentiality and integrity impacts, such as session hijacking or content manipulation. The vulnerability does not affect availability. The attack surface is restricted to authenticated administrators on multi-site or restricted unfiltered_html environments, reducing exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and consider disabling multi-site features or enabling unfiltered_html capability if feasible to reduce risk. Monitor official vendor channels for updates or patches addressing this vulnerability.