CVE-2026-7441 describes a stored cross-site scripting vulnerability in the Simple Yearly Archive plugin for WordPress. The flaw exists in all versions up to and including 2.2.4 due to improper neutralization of input in the posttype attribute of the SimpleYearlyArchive shortcode. Authenticated attackers with Contributor-level permissions or above can inject arbitrary JavaScript code that executes in the context of users viewing the injected pages. This vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.4, indicating medium severity.

An attacker with Contributor-level access or higher can exploit this vulnerability to inject malicious scripts that execute in the browsers of users who visit the compromised pages. This can lead to information disclosure and integrity impacts, such as session hijacking or unauthorized actions performed on behalf of users. There is no impact on availability reported. No known exploits in the wild have been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access and above to trusted users only. Monitor for plugin updates from alphawolf that address this vulnerability and apply them promptly once released.