The Arena.IM – Live Blogging for real-time events WordPress plugin contains a stored cross-site scripting vulnerability (CWE-79) in the 'arena_embed_amp' shortcode due to improper neutralization of user-supplied input. Authenticated users with contributor-level permissions or higher can inject arbitrary web scripts that persist and execute in the context of any user viewing the injected content. This vulnerability affects all versions up to 0.4.1. The CVSS 3.1 score is 6.4 (medium severity), with attack vector network, low attack complexity, requiring privileges, no user interaction, and impacts on confidentiality and integrity but not availability. No patch or official fix has been documented, and no known exploits are reported.

The vulnerability allows authenticated contributors or higher to inject persistent malicious scripts into pages via the vulnerable shortcode. This can lead to unauthorized actions performed in the context of other users viewing the affected pages, potentially compromising confidentiality and integrity of user data. There is no impact on availability. Since exploitation requires authenticated access, the risk is limited to environments where contributor-level accounts are granted.

No official patch or fix is currently available for this vulnerability. Users should restrict contributor-level access to trusted individuals only and consider disabling or removing the Arena.IM plugin until a vendor update is released. Monitor the vendor's advisory channels for any forthcoming patches or remediation guidance. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.