CVE-2026-76562

CVE-2026-76562 is a stored cross-site scripting (XSS) vulnerability in the Sidebar Manager Light plugin for WordPress, caused by insufficient input sanitization and output escaping of the 'sbm_description' parameter. Because that parameter is not properly cleaned before being rendered, an unauthenticated attacker can inject arbitrary web script into a page, and the injected script executes whenever any user accesses the injected page. Successful exploitation lets the attacker run JavaScript in the browsers of site visitors, consistent with the CVSS low confidentiality and integrity impacts (e.g., hijacking user interactions, altering displayed content, or redirecting users). Any WordPress site running Sidebar Manager Light version 1.18 or earlier is affected. There is currently no public proof-of-concept, the flaw is not in CISA KEV, and no in-the-wild exploitation is known.

What to do: Sites running Sidebar Manager Light should upgrade to the first patched release published after version 1.18 as soon as it is available, and monitor Wordfence advisories for the fixed version number. Until patching, consider deactivating the plugin and audit stored 'sbm_description' values and affected pages for unexpected HTML or script content that may already have been injected.