CVE-2026-9729 is a stored cross-site scripting vulnerability in the Webpushr Push Notifications WordPress plugin. The issue stems from the save_send_notification_flag() function not properly sanitizing input and the wpp_notification_box() function failing to escape output when rendering the 'webpushr_notification_title' and 'webpushr_notification_body' parameters. This allows authenticated users with contributor or higher privileges to inject arbitrary scripts into pages, which execute upon page access by other users. The vulnerability affects versions up to and including 4.39.0. There is no vendor advisory or patch information currently available.

An attacker with contributor-level or higher access can exploit this vulnerability to inject malicious scripts that execute in the context of other users viewing the injected pages. This can lead to theft of user credentials, session hijacking, or other actions permitted by the victim's browser context. The vulnerability does not impact availability but compromises confidentiality and integrity to a limited extent, as reflected by the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Webpushr Push Notifications plugin if possible. Monitor official Webpushr channels for updates or patches addressing this vulnerability.