CVE-2026-9620 is a stored cross-site scripting vulnerability in the WP Latest Posts plugin for WordPress, affecting versions up to and including 5.0.11. The vulnerability arises from improper output escaping in the field() and loop() functions, which extract raw src attribute values from <img> tags in post content using regular expressions and then reconstruct new <img> elements or CSS background-image declarations by concatenating unescaped values. This bypasses WordPress's kses filtering, enabling authenticated attackers with author-level privileges or higher to inject arbitrary web scripts that execute in the context of users viewing the injected pages.

An attacker with author-level or higher privileges can inject malicious scripts into post content that execute in the browsers of users who view the compromised pages. This can lead to theft of user credentials, session hijacking, or other malicious actions limited to the privileges of the injected script. The vulnerability does not affect availability but impacts confidentiality and integrity of user interactions with the affected site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict author-level access to trusted users only and consider disabling or replacing the WP Latest Posts plugin if possible. Monitor vendor channels for updates and apply patches promptly once released.