CVE-2026-9019 is a stored cross-site scripting vulnerability in the Easy Image Collage plugin for WordPress affecting all versions up to and including 1.13.6. The vulnerability arises from improper neutralization of input in the 'grid[properties][borderColor]' and 'grid[images][N][attachment_url]' parameters. Authenticated attackers with author-level access or higher can inject arbitrary web scripts that execute when a user accesses the injected page. The attack bypasses WordPress's unfiltered_html capability restrictions because the malicious data is stored using update_post_meta() instead of wp_insert_post(), allowing authors to exploit this vector despite capability controls. No official patch or remediation level has been published yet.

An attacker with author-level privileges or higher can inject persistent malicious scripts into pages via vulnerable parameters. These scripts execute in the context of users viewing the affected pages, potentially leading to information disclosure or session hijacking. The vulnerability does not affect availability but impacts confidentiality and integrity. The CVSS 3.1 base score of 6.4 reflects a medium severity with network attack vector, low attack complexity, and privileges required at the author level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict author-level access to trusted users only and consider monitoring or filtering inputs to the vulnerable parameters if possible. No official patch or workaround has been published at this time.