CVE-2026-81754 is a stored cross-site scripting vulnerability in the Vigilant – 100% Free Security Suite WordPress plugin (versions up to and including 2.10.2). The vulnerability occurs because the plugin does not properly sanitize or escape the User-Agent header input before including it in web pages. An unauthenticated attacker can craft a malicious User-Agent header that is stored and then executed in the context of users visiting pages that trigger a failed login attempt. This can lead to arbitrary script execution in the victim's browser without requiring further interaction from the attacker.

Successful exploitation allows an unauthenticated attacker to inject and execute arbitrary JavaScript in the context of users visiting the vulnerable site, potentially leading to session hijacking, defacement, or other client-side impacts. The vulnerability does not affect availability but compromises confidentiality and integrity of user interactions.

A fix is available in versions later than 2.10.2. Users should upgrade the Vigilant plugin to a version higher than 2.10.2 once released. Until then, consider restricting or sanitizing User-Agent headers at the web server or application firewall level as a temporary mitigation. Monitor the vendor advisory for official patch releases.