The WP Front User Submit / Front Editor plugin for WordPress versions up to 4.4.7 suffers from a stored cross-site scripting vulnerability due to improper neutralization of input during web page generation. Authenticated attackers with administrator privileges can exploit this by injecting malicious scripts via form settings. These scripts execute in the context of users viewing the compromised pages, potentially leading to information disclosure or session hijacking. The vulnerability only affects multi-site setups or installations with unfiltered_html disabled, limiting its scope. No official patch or vendor advisory is provided in the available data.

An attacker with administrator-level permissions can inject persistent malicious scripts into pages, which execute when other users access those pages. This can lead to limited confidentiality and integrity impacts such as theft of user credentials or unauthorized actions performed on behalf of users. The vulnerability does not affect availability. The impact is constrained by the requirement for high privileges and specific WordPress configurations (multi-site or unfiltered_html disabled).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and consider disabling or removing the vulnerable plugin in affected environments. Monitor for plugin updates from the vendor that address this vulnerability.