CVE-2026-6690 is a stored XSS vulnerability in the LifePress WordPress plugin (versions up to 2.2.2). The vulnerability exists because the 'wp_ajax_nopriv_lp_update_mds' AJAX action is registered without nonce verification or capability checks, allowing unauthenticated attackers to submit malicious input via the 'n' parameter. The plugin fails to properly sanitize and escape this input when displaying the series name in the admin settings page, enabling script injection that executes in the context of users viewing the page.

Successful exploitation allows unauthenticated attackers to inject and execute arbitrary JavaScript in the context of authenticated users accessing the admin settings page. This can lead to session hijacking, privilege escalation, or other malicious actions limited to the privileges of the affected user. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — no official fix or patch is currently available. Users should monitor the vendor's advisory channels for updates. Until a patch is released, restricting access to the admin settings page and disabling the vulnerable AJAX action if possible may reduce risk. Avoid using the affected versions of the plugin in sensitive environments.