Threats tagged 'ghsa-26m8-g7wc-p86g'

CVE-2026-16273 is a medium severity Cross-Site Scripting (XSS) vulnerability in the Narrative Publisher WordPress plugin up to version 1.0.7. It allows users with contributor-level access or higher to inject JavaScript into a REST-exposed post meta field that is not properly escaped when rendered. This malicious script executes in the browsers of higher-privileged users who view the affected post, potentially leading to limited confidentiality and integrity impacts.