The CWW Companion plugin for WordPress suffers from a stored XSS vulnerability (CWE-79) in the Module2 widget due to inadequate sanitization and escaping of user-supplied attributes. Authenticated attackers with contributor-level or higher privileges can inject arbitrary JavaScript code that executes in the context of other users viewing the infected page. This vulnerability affects all versions up to and including 1.2.7. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, and partial confidentiality and integrity impact with no availability impact. There is no indication of known exploits in the wild or vendor-provided patches at this time.

An authenticated user with contributor or higher permissions can inject persistent malicious scripts into pages via the vulnerable widget. These scripts execute in the browsers of users who visit the infected pages, potentially leading to partial confidentiality and integrity compromise of user data or session information. The vulnerability does not impact availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Module2 widget in the CWW Companion plugin to prevent exploitation.