The Content Views – Post Grid & Filter, Recent Posts, Category Posts plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated users with administrator-level permissions can inject arbitrary scripts via admin settings, which are then stored and executed in the context of users visiting the injected pages. This vulnerability affects all plugin versions up to 3.6.2 and is limited to multi-site installations or those where unfiltered_html is disabled. The CVSS 3.1 base score is 4.4, reflecting network attack vector, high attack complexity, required privileges, no user interaction, and partial impact to confidentiality and integrity.

An attacker with administrator-level privileges can inject malicious JavaScript code into pages generated by the plugin, which executes in the browsers of users who visit those pages. This can lead to partial confidentiality and integrity impacts, such as theft of session tokens or modification of displayed content. The vulnerability does not affect availability. Exploitation requires high privileges and no user interaction is needed once the malicious script is stored. The vulnerability is limited to multi-site WordPress installations or those with unfiltered_html disabled.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider disabling or removing the affected plugin in multi-site environments or where unfiltered_html is disabled. Monitor official pt-guy plugin updates and WordPress security advisories for patches addressing this vulnerability.