CVE-2026-7850 is a stored XSS vulnerability in the WP Magnific Popup WordPress plugin (up to version 1.0). The vulnerability arises because the plugin does not properly sanitize or escape user-supplied link URLs before injecting them into the DOM during image load error message display. Authenticated attackers with Author-level privileges or above can exploit this to perform stored XSS attacks, potentially impacting any user who views the affected content.

An attacker with Author-level access or higher can inject malicious scripts that execute in the context of other users' browsers when they view the affected image error messages. This can lead to session hijacking, defacement, or other malicious actions executed on behalf of the victim user. The vulnerability requires authentication at Author level or above, limiting exploitation to users with some level of trust on the site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Author-level access to trusted users only and consider disabling or replacing the WP Magnific Popup plugin to prevent exploitation.