CVE-2026-16273

Name of the Vulnerable Software and Affected Versions Narrative Publisher versions prior to 1.0.8

Description Insufficient restriction of write access to a REST-exposed post meta field and a failure to escape data during rendering allow users with contributor-level access and above to perform a Stored Cross-Site Scripting (XSS) attack. This occurs via the narrative post script post meta, enabling the storage of malicious JavaScript that executes in the browser of any higher-privileged user who views the affected post.

Recommendations Update Narrative Publisher to version 1.0.8 or later.