The Newspaper WordPress theme suffers from a stored XSS vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, attachment meta data on archive pages does not properly sanitize or escape user input, allowing authenticated users with author-level access or above to inject malicious scripts. These scripts execute in the context of other users viewing the injected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to 12.6.5. The CVSS 3.1 base score is 5.5, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and partial impact on confidentiality and integrity.

An attacker with author-level or higher privileges can inject persistent malicious scripts into archive pages via attachment meta data. These scripts execute in the browsers of users who visit the compromised pages, potentially exposing sensitive information or enabling further attacks within the context of the affected site. The impact is limited to confidentiality and integrity, with no availability impact reported. The vulnerability requires authenticated access, reducing the attack surface compared to unauthenticated XSS.

No official patch or vendor advisory is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, administrators should restrict author-level access to trusted users only and consider disabling or limiting the use of attachment meta fields on archive pages if possible. Monitoring for suspicious script injections in user-generated content may help detect exploitation attempts.