CVE-2026-86790 describes a stored Cross-Site Scripting (CWE-79) vulnerability in the WP Highlight Box WordPress plugin through version 1.0. The vulnerability arises because the plugin does not properly escape certain shortcode attributes before outputting them on pages where the shortcode is embedded. This allows authenticated users with contributor or higher privileges to inject malicious scripts that persist and execute in the context of site visitors viewing the affected pages.

An attacker with contributor or higher privileges can exploit this vulnerability to perform stored XSS attacks, potentially leading to session hijacking, defacement, or other malicious actions executed in the context of users viewing the compromised content. The vulnerability requires at least contributor-level access, limiting exploitation to authenticated users with some level of trust.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider removing or disabling the WP Highlight Box plugin if possible.