CVE-2026-92767 describes a stored cross-site scripting vulnerability in the Twenty20 Image Before-After WordPress plugin by zayedbaloch. The vulnerability arises from improper neutralization of input in the 'offset' shortcode attribute, allowing authenticated contributors and above to inject arbitrary web scripts. This affects all plugin versions up to and including 2.0.5. The vulnerability is due to insufficient input sanitization and output escaping, enabling persistent script injection that executes upon page access.

An attacker with contributor-level or higher privileges can exploit this vulnerability to inject malicious scripts into pages. These scripts execute in the context of users who visit the compromised pages, potentially leading to session hijacking, defacement, or other client-side attacks. The CVSS score of 6.4 reflects a medium severity with low attack complexity, requiring privileges but no user interaction.

No official patch or fix is currently documented for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is available, restrict contributor-level access carefully and consider disabling or removing the plugin if possible to mitigate risk.