CVE-2026-9620 describes a stored cross-site scripting vulnerability in the WP Latest Posts plugin for WordPress. The issue is due to insufficient output escaping in the field() and loop() functions, which extract raw src attribute values from <img> tags in post content using regular expressions. These values are then directly concatenated into new <img> elements or CSS background-image declarations without proper sanitization, bypassing WordPress's kses filtering. Authenticated attackers with author-level privileges or higher can exploit this to inject arbitrary web scripts that execute when users access the injected pages.

An attacker with author-level access or higher can inject persistent malicious scripts into post content via crafted image src attributes. This can lead to execution of arbitrary scripts in the context of users viewing the affected pages, potentially compromising user sessions, stealing sensitive information, or performing actions on behalf of users. The vulnerability does not affect availability but impacts confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict author-level access to trusted users only and consider disabling or removing the WP Latest Posts plugin if possible. Monitor for vendor updates and apply patches promptly once released.