The WebSub WordPress plugin (formerly PubSubHubbub) suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated attackers with administrator privileges can inject arbitrary JavaScript into plugin settings, which is then stored and executed in the context of users visiting the affected pages. This vulnerability affects all versions up to and including 3.1.4. The CVSS 3.1 base score is 4.4, reflecting network attack vector, high attack complexity, high privileges required, no user interaction, and partial impact on confidentiality and integrity. No patch or vendor advisory is currently available to confirm remediation status.

An attacker with administrator-level access can inject malicious scripts that execute in the browsers of users viewing the affected pages, potentially leading to session hijacking, privilege escalation, or other script-based attacks. The impact is limited by the requirement for high privileges to exploit and the absence of user interaction. There is no indication of availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator-level access to trusted users only and consider monitoring plugin settings for unauthorized changes. Avoid exposing the plugin settings pages to untrusted users. Do not rely on generic mitigations as the vulnerability specifically involves stored XSS in plugin settings.