The WP Back Button plugin by Xabier Miranda contains a stored Cross Site Scripting (XSS) vulnerability (CWE-79) affecting versions up to 1.1.3. This vulnerability enables attackers with high privileges and requiring user interaction to execute arbitrary scripts in the context of the affected application, potentially leading to partial compromise of confidentiality, integrity, and availability. The CVSS 3.1 base score is 5.9, reflecting network attack vector, low attack complexity, high privileges required, user interaction needed, and a scope change. No patch or official remediation has been published yet.

Successful exploitation can lead to stored XSS attacks, allowing attackers to execute malicious scripts in users' browsers. This can result in partial loss of confidentiality, integrity, and availability of the affected system. However, exploitation requires high privileges and user interaction, which limits the ease of attack. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict high-privilege user access to the WP Back Button plugin and monitor for suspicious activity. Avoid interacting with untrusted content within the plugin's context.