CVE-2026-94081 is an unauthenticated cross-site scripting (XSS) vulnerability in the WordPress Persistent Login plugin versions up to 3.1.3. The flaw is due to improper neutralization of input during web page generation (CWE-79), allowing attackers to inject malicious scripts that execute in the context of the victim's browser. The CVSS 3.1 score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can allow an attacker to execute arbitrary scripts in the context of the victim's browser without authentication. This can lead to partial disclosure of sensitive information, modification of data, and disruption of service. The vulnerability affects the confidentiality, integrity, and availability of the affected WordPress site.

No patch or official fix information is currently provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or removing the WordPress Persistent Login plugin if feasible, and apply standard XSS mitigations such as input validation and output encoding where possible.