CVE-2026-88997 is a CWE-79 Cross-Site Scripting vulnerability in the JSM Show Post Metadata WordPress plugin prior to version 4.9.1. The vulnerability arises because the plugin does not properly escape post meta keys before outputting them into inline event-handler attributes in the admin interface. This enables users with contributor-level permissions or above to inject malicious JavaScript, which executes when a higher-privileged user reviews the post, potentially leading to session hijacking or other script-based attacks.

An attacker with contributor-level access or higher can inject arbitrary JavaScript code that executes in the context of a higher-privileged user viewing the post. This can lead to unauthorized actions performed with elevated privileges, such as session hijacking or other malicious activities within the admin session. The vulnerability affects the confidentiality and integrity of the admin user's session.

Upgrade the JSM Show Post Metadata plugin to version 4.9.1 or later, where this vulnerability is fixed. No other mitigation is indicated. Patch status is confirmed by the version boundary in the affectedVersions field.