CVE-2026-9677 is a stored XSS vulnerability in the Shariff for WordPress plugin (versions up to 1.0.11). The issue arises because the shariff_infourl setting is not properly sanitized or escaped before being rendered in the frontend HTML by the generateshariff() function. This allows users with high privileges (e.g., admins) to inject malicious scripts that persist in the site content. The vulnerability can be exploited even if the unfiltered_html capability is disabled, which is a common restriction in multisite WordPress environments. No official patch or remediation guidance has been provided at this time.

An attacker with high privileges on a WordPress site using the affected Shariff plugin versions can perform stored XSS attacks by injecting malicious scripts into the shariff_infourl setting. This can lead to the execution of arbitrary scripts in the context of users visiting the affected site, potentially compromising user sessions or performing unauthorized actions. The impact is limited to confidentiality and integrity with no direct availability impact. The vulnerability requires high privileges and user interaction (UI required).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrative access to trusted users only and consider disabling or removing the Shariff for WordPress plugin if possible. Monitor official channels for updates or patches addressing this vulnerability.