CVE-2026-7660 is a reflected cross-site scripting vulnerability in the Easy Updates Manager plugin for WordPress, affecting versions up to and including 9.0.20. The issue arises from improper neutralization of input in the 'paged' parameter handled by the pagination() function, which fails to sanitize and escape user input properly. This allows an attacker to inject arbitrary web scripts that execute when an administrator accesses a crafted page. The vulnerability has a CVSS 3.1 score of 6.1 (medium severity) with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality and integrity but not availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of an administrator's browser session, potentially allowing theft of sensitive information or unauthorized actions performed with administrator privileges. However, exploitation requires user interaction (administrator clicking a malicious link). There is no indication of impact on system availability. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on untrusted links and consider restricting access to the plugin's administrative interfaces. Monitor vendor channels for updates and apply patches promptly once released.