CVE-2026-8628 describes a reflected Cross-Site Scripting vulnerability in the EntreDroppers WordPress plugin by owencutajar. The flaw exists in all versions up to and including 1.1.2 due to improper neutralization of input in the PHP_SELF parameter. An attacker can craft a URL containing malicious script code in the path-info, which PHP_SELF reflects into the form action attribute without proper sanitization or escaping. This allows execution of arbitrary scripts in the context of the victim's browser when they click a malicious link, potentially leading to session hijacking or other client-side impacts. The vulnerability has a CVSS 3.1 base score of 6.1, indicating medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and partial confidentiality and integrity impact.

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of the victim's browser via reflected XSS. This can lead to theft of user credentials, session tokens, or other sensitive information accessible to the browser. The vulnerability does not impact availability. The medium CVSS score reflects the need for user interaction and limited scope of impact.

No official patch or remediation is currently confirmed for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid clicking suspicious links that may exploit this reflected XSS. Site administrators should monitor for updates from the plugin vendor and apply patches promptly once released.