The YARPP WordPress plugin versions up to 5.30.9 contain a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated administrators can inject malicious scripts via the plugin's admin settings. These scripts execute in the context of users visiting the affected pages, potentially leading to information disclosure or session hijacking. The vulnerability is limited to multi-site setups or installations with unfiltered_html disabled. There is no indication of a vendor-provided patch or official remediation at this time.

An attacker with administrator-level access can inject persistent malicious scripts into pages generated by the YARPP plugin. When other users access these pages, the injected scripts execute in their browsers, potentially compromising user data or session integrity. The impact is limited to environments where multi-site is enabled or unfiltered_html is disabled. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only, and consider disabling or removing the YARPP plugin in multi-site or unfiltered_html-disabled environments to prevent exploitation.