CVE-2026-92967 describes a reflected XSS vulnerability in the Pochipp WordPress plugin versions up to and including 1.20.2. The flaw is due to improper neutralization of input during web page generation: the 'keyword' parameter from $_GET is sanitized only with sanitize_text_field(), which removes tags but leaves double quotes intact. This value is then directly interpolated into the value attribute of a search input field without using esc_attr(), enabling injection of malicious scripts. Exploitation requires tricking a user with upload_files capability to click a crafted link to /wp-admin/media-upload, causing script execution in their browser.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of an authenticated user with upload_files capability (Author or higher). This can lead to limited confidentiality and integrity impacts such as theft of cookies or performing actions on behalf of the user. The CVSS score is 6.1 (medium severity), reflecting the need for user interaction and limited privilege requirements.

No official patch or fix is currently documented. Users should monitor the vendor advisory for updates. Until a fix is available, restrict access to users with upload_files capability and avoid clicking suspicious links. Applying proper output escaping (esc_attr()) on the 'keyword' parameter in the plugin code would mitigate this issue.