CVE-2026-6690 is a stored cross-site scripting vulnerability in the LifePress WordPress plugin (versions up to 2.2.2). The issue arises from the 'lp_update_mds' AJAX action being registered without nonce verification or capability checks, combined with inadequate sanitization and escaping of the 'n' parameter used for the series name. This allows unauthenticated attackers to inject arbitrary JavaScript that executes in the context of the admin settings page, potentially leading to session hijacking or other script-based attacks. The vulnerability is tracked under CWE-79 and has a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N). No known exploits in the wild have been reported, and no official patch or vendor advisory is currently available.

Successful exploitation allows unauthenticated attackers to inject and execute arbitrary scripts in the context of the WordPress admin settings page, potentially leading to information disclosure or limited integrity impact. The vulnerability does not affect availability. The CVSS score of 7.2 reflects a high severity with network attack vector, no privileges or user interaction required, and partial confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling or removing the LifePress plugin if possible. Monitoring for updates from the vendor or trusted security sources is recommended. Applying general WordPress security best practices may help reduce risk but will not fully mitigate this specific vulnerability.