The Admin Page Spider WordPress plugin (versions up to 3.31) contains a stored cross-site scripting vulnerability due to improper neutralization of input during web page generation. Authenticated administrators can inject malicious scripts via the plugin's admin settings, which execute when users view the injected pages. This vulnerability affects multi-site WordPress setups or installations with unfiltered_html disabled. The CVSS 3.1 score is 4.4 (medium severity), reflecting network attack vector, high attack complexity, required privileges at the administrator level, no user interaction, and partial impact on confidentiality and integrity. No patch or remediation information is provided in the vendor or CVE data.

An attacker with administrator-level access can inject persistent malicious scripts into pages generated by the plugin. These scripts execute in the context of users who visit the affected pages, potentially leading to partial confidentiality and integrity compromise. The vulnerability does not affect availability. Exploitation requires high privileges and affects multi-site or restricted HTML capability environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider disabling or removing the Admin Page Spider plugin in multi-site or unfiltered_html-disabled environments to prevent exploitation.