CVE-2026-9738 is a stored cross-site scripting vulnerability (CWE-79) in the Print, PDF & Email by PrintFriendly WordPress plugin. It affects all versions up to 5.5.10 due to improper neutralization of input in the 'content_position_css' parameter. Authenticated attackers with administrator or higher privileges can inject arbitrary web scripts that execute in the context of users visiting the injected pages. The CVSS 3.1 base score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, high privileges required, no user interaction, and partial impact on confidentiality and integrity.

An attacker with administrator-level access can exploit this vulnerability to inject malicious scripts that execute in the browsers of users viewing the compromised pages. This can lead to partial confidentiality and integrity impacts, such as theft of sensitive information or unauthorized actions performed on behalf of users. There is no impact on availability. No known exploits in the wild have been reported.

No official patch or remediation level has been published yet for this vulnerability. Users should monitor the vendor's advisory for updates and apply any forthcoming patches promptly. Until a fix is available, restrict administrator-level access to trusted users only to reduce risk. Review and sanitize inputs related to the 'content_position_css' parameter if possible through custom controls or plugins.