This vulnerability (CWE-79) in WP Next Post Navi allows an attacker with high privileges and requiring user interaction to inject malicious scripts that are stored and later executed in the context of the web application. The CVSS 3.1 score of 5.9 reflects a medium severity with network attack vector, low attack complexity, and partial impacts on confidentiality, integrity, and availability. The vulnerability affects all versions up to 1.8.3. No patch or official remediation level has been published, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker with high privileges to execute stored malicious scripts, potentially leading to partial disclosure of information, modification of data, or disruption of service. However, exploitation requires user interaction and privileges, limiting the overall impact severity to medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high-privilege user access and monitor for suspicious activity related to this plugin. Avoid enabling untrusted input that could be stored and rendered by the plugin.