CVE-2026-97020: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in dougwollison PO/MO Editor

CVE-2026-97020 is a stored cross-site scripting vulnerability in the dougwollison PO/MO Editor WordPress plugin affecting all versions up to 1.4.2. The vulnerability arises from insufficient sanitization and escaping of the 'podata' parameter, allowing authenticated users with subscriber or higher privileges to inject arbitrary scripts. These scripts are loaded as replacement .po/.mo translation files via the plugin's load_textdomain_mofile filter, causing malicious payloads to execute in the context of users accessing the injected pages.

An attacker with subscriber-level or higher access can inject persistent malicious scripts that execute in the browsers of users who visit the compromised pages. This can lead to information disclosure and integrity impacts, such as theft of user credentials or session tokens. The CVSS score of 6.4 reflects a medium severity with network attack vector, low attack complexity, and no user interaction required.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is released, restrict plugin usage to trusted users only and consider disabling or removing the PO/MO Editor plugin if possible to prevent exploitation.