CVE-2026-7662 is a stored cross-site scripting vulnerability in the ePaperFlip Publisher plugin for WordPress. The issue is due to improper neutralization of input in the 'publicationid' attribute of the epaperflip_embed shortcode, which is directly injected into inline JavaScript without adequate sanitization or escaping. Authenticated users with Contributor or higher privileges can exploit this to inject arbitrary scripts that execute when other users access the compromised page. The vulnerability has a CVSS 3.1 base score of 6.4, indicating a medium severity impact. No patch or official remediation has been published as of the current data.

Successful exploitation allows an authenticated user with Contributor-level or higher privileges to inject and execute arbitrary JavaScript in the context of other users viewing the affected pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or content manipulation. There is no indication of availability impact. The vulnerability requires authentication and leverages stored XSS via shortcode attributes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider removing or disabling the ePaperFlip Publisher plugin if feasible. Monitor for updates from the vendor or security community regarding patches or workarounds.