CVE-2026-85575 is a stored cross-site scripting vulnerability in the ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress. The flaw exists in the 'shopengine_product_title_header_size' parameter due to inadequate input sanitization and output escaping. Authenticated attackers with Author-level privileges or above can inject arbitrary scripts that execute in the context of users viewing the injected pages. This vulnerability affects all versions from 0 through 4.9.5 inclusive.

Successful exploitation allows an authenticated user with Author-level or higher privileges to inject and execute arbitrary JavaScript in the context of other users viewing the affected pages. This can lead to information disclosure and limited integrity impact. The CVSS v3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and partial confidentiality and integrity impact. There is no known active exploitation in the wild.

No official patch or fix is currently documented. Users should monitor the vendor's advisory channels for updates. Until a fix is available, restrict Author-level access to trusted users only and consider additional input validation or output encoding controls if possible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.