The Taskbuilder WordPress plugin (up to version 3.0.6) suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input in the wppm_tasks shortcode. Authenticated attackers with contributor or higher privileges can inject arbitrary JavaScript that executes in the context of users viewing the injected content. This vulnerability allows for potential compromise of user sessions or actions within the affected WordPress site. No patch or official fix details are currently provided.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the wppm_tasks shortcode. These scripts execute in the browsers of users who access the infected pages, potentially leading to session hijacking, unauthorized actions, or data exposure limited to the privileges of the victim user. The vulnerability does not impact availability and requires authentication, which limits the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Taskbuilder plugin if possible. Monitor for updates from the vendor regarding patches or official mitigations.