CVE-2026-76562 is a stored cross-site scripting vulnerability in the Sidebar Manager Light plugin for WordPress. The vulnerability arises from insufficient input sanitization and output escaping of the 'sbm_description' parameter in all versions up to and including 1.18. An unauthenticated attacker can exploit this to inject arbitrary web scripts that execute in the context of users visiting the injected pages. The CVSS v3.1 base score is 7.2, reflecting a high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity with a scope change.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of users viewing the affected pages, potentially leading to theft of sensitive information or session hijacking. The vulnerability impacts confidentiality and integrity but does not affect availability.

No official patch or remediation is currently confirmed. Users should monitor the vendor's advisory for updates. Until a fix is available, consider disabling or removing the Sidebar Manager Light plugin if feasible, or applying manual input sanitization and output escaping as a temporary mitigation.