CVE-2026-97279 is a CWE-79 (Improper Neutralization of Input During Web Page Generation) vulnerability in the Polylang plugin (versions <= 3.8.9) developed by Chouby. It allows contributor-level users to perform cross-site scripting (XSS) attacks by injecting malicious input that is not properly sanitized before being rendered in web pages. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with network attack vector, low attack complexity, privileges required at the contributor level, user interaction required, and impacts on confidentiality, integrity, and availability.

An attacker with contributor privileges could exploit this vulnerability to execute arbitrary scripts in the context of the affected website, potentially leading to data disclosure, modification, or disruption of service. The impact affects confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector. There are no known exploits in the wild at this time.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor privileges and avoid untrusted input where possible.