The Announce from the Dashboard plugin for WordPress suffers from a stored cross-site scripting vulnerability due to insufficient input sanitization and output escaping in admin settings. Authenticated administrators can inject arbitrary web scripts that persist and execute in the context of users visiting the injected pages. This issue impacts multi-site WordPress installations or those with unfiltered_html disabled, affecting all plugin versions up to and including 1.5.2. The CVSS 3.1 base score is 4.4, reflecting a medium severity with high attack complexity and requiring administrator privileges.

An attacker with administrator-level access can inject persistent malicious scripts that execute in the browsers of users viewing the affected pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed on behalf of users. The vulnerability does not affect single-site installations or those with unfiltered_html enabled. There are no known exploits in the wild at this time.

No official patch or fix information is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is released, restrict administrator access to trusted users only and consider disabling or removing the Announce from the Dashboard plugin in multi-site environments or those with unfiltered_html disabled to mitigate risk.