CVE-2026-8354 is a stored cross-site scripting vulnerability in the Gum Addon for Elementor WordPress plugin. The flaw exists in all versions up to and including 1.3.15 due to improper neutralization of input in the 'pop_tag' parameter. Authenticated attackers with contributor-level privileges or above can inject arbitrary web scripts that execute in the context of users visiting the compromised pages. The vulnerability has a CVSS 3.1 base score of 6.4, indicating medium severity, with network attack vector, low attack complexity, and no user interaction required. The impact includes partial confidentiality and integrity loss but no availability impact.

An attacker with contributor-level access or higher can exploit this vulnerability to inject malicious scripts into pages, which execute when viewed by other users. This can lead to partial compromise of confidentiality and integrity, such as session hijacking or unauthorized actions performed on behalf of users. There is no reported impact on availability. No known exploits are currently reported in the wild.

No official patch or fix is currently documented for this vulnerability. Users should monitor the vendor's advisories for updates. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Gum Addon for Elementor plugin if possible to mitigate risk.