CVE-2026-76558 is a stored XSS vulnerability in WP Import Export Lite plugin versions prior to 3.9.33. The flaw arises because custom field names are not properly escaped before being inserted into the DOM of an admin interface screen. An attacker with contributor-level access can exploit this to inject persistent malicious scripts that execute in the context of higher-privileged users who access the affected screen, potentially leading to session hijacking or other attacks.

Users with contributor roles can inject malicious scripts that execute in the browsers of administrators or other high-privileged users viewing the affected admin screen. This can lead to compromise of administrative accounts or unauthorized actions performed with elevated privileges.

Upgrade WP Import Export Lite to version 3.9.33 or later, where this vulnerability is fixed. No other mitigation steps are indicated. Patch status is not explicitly confirmed by a vendor advisory, but the affected versions are clearly defined and the fixed version is 3.9.33.