The Clever Fox WordPress plugin suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of user-supplied input in the info box block. Authenticated users with contributor or higher privileges can inject arbitrary JavaScript code that executes in the context of other users viewing the affected pages. This vulnerability affects all plugin versions up to 25.2.0. The CVSS 3.1 base score is 6.4 (medium), reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and partial impact on confidentiality and integrity. No patch or official remediation guidance is currently provided by the vendor.

Successful exploitation allows an authenticated contributor or higher user to inject and execute arbitrary scripts in the context of other users visiting the affected pages. This can lead to partial confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed on behalf of other users. There is no impact on availability reported. No known active exploitation has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the Clever Fox plugin if feasible. Monitor for updates from nayrathemes regarding a security patch.