CVE-2026-9626 describes a stored Cross-Site Scripting vulnerability in the JSON API User WordPress plugin (versions up to 4.1.0). The issue is due to the post_comment() function passing attacker-controlled comment_content directly to wp_insert_comment() without HTML sanitization. Additionally, the API allows setting comment_approved=1, enabling attackers with subscriber-level privileges to self-approve malicious comments and bypass moderation. This results in arbitrary script execution in the context of users visiting the injected pages.

An authenticated attacker with subscriber-level access or higher can inject persistent malicious scripts into comments that execute in the browsers of users viewing those comments. This can lead to theft of user credentials, session hijacking, or other client-side attacks. The vulnerability also bypasses comment moderation, increasing the risk of widespread exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level access where possible and monitor for suspicious comments. Implement manual moderation to detect and remove malicious comments. Avoid relying solely on the plugin's comment approval process.