CVE-2026-6858 is a stored XSS vulnerability (CWE-79) in the Transbank Webpay WordPress plugin versions prior to 1.14.0. The issue arises because the plugin does not properly sanitize or escape log data before displaying it in the administrator interface. This allows unauthenticated attackers to inject malicious scripts into the logs, which execute when viewed by an administrator, potentially leading to session hijacking or other malicious actions within the admin context.

An unauthenticated attacker can inject persistent malicious scripts into the logs that are rendered in the administrator's browser. This can lead to compromise of administrator sessions, unauthorized actions performed with administrator privileges, or theft of sensitive information accessible to the admin user. The vulnerability affects the confidentiality and integrity of the administrative interface.

No official fix or patch information is currently available. Users should monitor the vendor's advisory for updates and apply the official patch once released. Until then, restrict access to the plugin's administrative interfaces and logs to trusted users only. Avoid exposing the admin interface publicly and consider disabling or limiting logging features if feasible.