CVE-2026-9626 is a stored cross-site scripting vulnerability in the JSON API User WordPress plugin (<=4.1.0). The issue stems from the post_comment() function passing attacker-controlled comment_content directly to wp_insert_comment() without HTML sanitization. Additionally, the API allows setting comment_approved=1, enabling attackers with subscriber-level privileges to bypass moderation and inject persistent malicious scripts that execute in users' browsers when viewing the compromised content.

An attacker with subscriber-level or higher privileges can inject arbitrary web scripts that persist in comments and execute in the context of users visiting the affected pages. This can lead to information disclosure, session hijacking, or other client-side attacks. The vulnerability does not impact availability but compromises confidentiality and integrity of user interactions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user permissions where possible and monitor for suspicious comment activity. Avoid using the vulnerable plugin version or disable the post_comment API endpoint if feasible.