CVE-2026-8626 is a reflected cross-site scripting vulnerability in the SponsorMe WordPress plugin by owencutajar, affecting all versions up to 0.5.2. The issue arises from improper neutralization of input in the PHP_SELF parameter, which is reflected unsafely in both a form action attribute and an anchor href attribute within the plugin's code. An attacker can craft a URL containing malicious script code appended to the wp-admin/admin.php path, which, when clicked by a user, executes the injected script in the user's browser context. This vulnerability requires no privileges but does require user interaction. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability. No patch or official remediation level has been published by the vendor as of the publication date.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected site for users who click a crafted link. This can lead to limited confidentiality and integrity impacts such as session hijacking or content manipulation. There is no impact on availability. The vulnerability requires user interaction and does not require authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking suspicious links targeting the vulnerable plugin's admin interface. Consider disabling or removing the SponsorMe plugin if it is not essential. Implementing web application firewall (WAF) rules to detect and block malicious payloads in URLs may provide temporary protection.