CVE-2026-8909 is a CSRF vulnerability in the WpMobi WordPress plugin (versions up to 0.0.3) caused by missing or incorrect nonce validation on the handleSaveGeneralSettings function. This flaw enables unauthenticated attackers to craft requests that, when executed by an administrator, modify plugin settings and inject arbitrary JavaScript into the admin's browser through the unescaped app_name parameter. The script injection occurs even if the input fails validation and is not persisted, due to the form re-rendering with the attacker-controlled value in memory. This vulnerability does not require privileges and relies on social engineering to trick an admin into performing the action.

An attacker can exploit this vulnerability to inject arbitrary scripts into an administrator's browser session, potentially leading to limited impact such as interface manipulation or session-based attacks. The vulnerability does not allow direct data confidentiality compromise or denial of service. The CVSS vector indicates no confidentiality or availability impact but a low integrity impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking on untrusted links or performing actions from untrusted sources that could trigger the vulnerable function. Monitoring for updates from the plugin author or WordPress security advisories is recommended.