CVE-2026-6913 is a stored cross-site scripting vulnerability in the Shortcodely WordPress plugin (versions up to 1.0.1). It occurs due to improper neutralization of input in the 'widget_area' parameter, allowing authenticated contributors or higher to inject arbitrary scripts that execute in the context of users viewing the injected pages. This vulnerability can lead to limited confidentiality and integrity impacts but does not affect availability. The vulnerability requires network access and low attack complexity but does require privileges (contributor or above) and no user interaction is needed once the malicious content is injected.

Successful exploitation allows an authenticated user with contributor-level privileges or higher to inject and execute arbitrary JavaScript in the context of other users visiting the affected pages. This can lead to limited confidentiality and integrity impacts such as session hijacking or content manipulation. There is no impact on system availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the Shortcodely plugin if possible. Monitor vendor channels for updates and apply patches promptly once available.