CVE-2026-7543 describes a stored XSS vulnerability in the Breakdance WordPress plugin affecting versions up to 2.7.1. The issue is due to improper sanitization and escaping of the 'fields' parameter, enabling attackers without authentication to inject arbitrary web scripts. These scripts execute in the context of users visiting the compromised pages, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, no privileges or user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

An unauthenticated attacker can inject persistent malicious scripts via the 'fields' parameter, which execute in the browsers of users visiting the affected pages. This can lead to limited confidentiality and integrity impacts such as theft of user data or session tokens. Availability is not affected. The scope is changed, meaning the vulnerability affects components beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected plugin or disable it if possible. Monitor official Breakdance plugin channels for updates and apply patches promptly once released.