CVE-2026-7613 is a stored cross-site scripting vulnerability in the Cost of Goods by PixelYourSite WordPress plugin, affecting versions up to and including 1.2.12. The issue is due to improper neutralization of input during web page generation, specifically in the 'csvdata[0][cost_of_goods_value]' parameter. This allows unauthenticated attackers to inject malicious scripts that execute in the context of users viewing the injected pages. The vulnerability has a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), indicating network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, and impacts confidentiality and integrity partially without affecting availability.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of users accessing the affected pages, potentially leading to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality and integrity. Availability is not affected. No known exploits have been reported in the wild.

Patch status is not yet confirmed — no official fix or remediation guidance is currently available from the vendor. Users should monitor the vendor's advisory channels for updates. Until a patch is released, consider restricting access to affected plugin functionality or disabling the plugin if feasible to mitigate risk.