This vulnerability (CVE-2026-65522) is a contributor-level cross-site scripting (XSS) issue in the Manual WordPress theme by pixelacehq, affecting versions up to 7.5.4. It stems from improper neutralization of input during web page generation, classified under CWE-79. The CVSS 3.1 base score is 6.5 (medium), with network attack vector, low attack complexity, requiring privileges at contributor level, user interaction, and resulting in partial confidentiality, integrity, and availability impacts. No patch or official remediation level has been disclosed as of the publication date.

Successful exploitation could allow an attacker with contributor privileges to execute arbitrary scripts in the context of the affected website, potentially leading to partial disclosure of sensitive information, modification of content, or disruption of availability. The vulnerability affects confidentiality, integrity, and availability to a limited extent due to the required privileges and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor privileges and monitor for suspicious activity related to script injection. Avoid granting contributor access to untrusted users.