The NACC WordPress Plugin versions up to 4.1.0 suffer from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, the plugin fails to adequately sanitize and escape user-supplied attributes in the 'nacc' shortcode, allowing authenticated users with contributor-level privileges or higher to inject arbitrary JavaScript code. This code executes in the context of any user who views the compromised page, potentially leading to session hijacking or other script-based attacks. The vulnerability is network exploitable with low attack complexity and requires privileges but no user interaction. The CVSS 3.1 base score is 6.4 (medium severity). No patch or official fix has been documented.

An authenticated attacker with contributor-level access or higher can inject persistent malicious scripts into pages via the 'nacc' shortcode. These scripts execute in the browsers of users who visit the infected pages, potentially leading to data theft, session hijacking, or other client-side attacks. The vulnerability does not affect availability and requires some privileges to exploit. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the NACC WordPress Plugin if possible. Monitor plugin updates from the vendor for a security patch addressing this vulnerability.