CVE-2026-8624 is a reflected cross-site scripting vulnerability in the etspring LJ comments import: reloaded WordPress plugin (versions up to 0.97.1). The vulnerability arises because the PHP_SELF parameter, which includes attacker-controlled PATH_INFO, is echoed twice without proper sanitization or escaping in the same function. This allows unauthenticated attackers to inject malicious scripts that execute in the context of the victim's browser when they click a crafted link. The CVSS 3.1 base score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity.

Successful exploitation can lead to execution of arbitrary scripts in the victim's browser, potentially resulting in theft of user credentials, session tokens, or other sensitive information accessible via the browser context. The vulnerability does not impact availability and requires user interaction to trigger.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. As a temporary measure, administrators may consider disabling or removing the vulnerable plugin until a fix is released. Additionally, applying web application firewall (WAF) rules to detect and block suspicious requests targeting PHP_SELF parameters may help mitigate risk.