The Content Views WordPress plugin (up to version 3.7.0) suffers from a stored cross-site scripting vulnerability (CWE-79) in its Widget Post Overlay block. This flaw arises from improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of user-supplied attributes. Authenticated attackers with contributor-level privileges or higher can exploit this to inject malicious scripts that execute in the context of users visiting the compromised pages. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and impacts on confidentiality and integrity with no availability impact. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable widget. These scripts execute in the browsers of users who view the affected pages, potentially leading to unauthorized actions or data disclosure limited to the confidentiality and integrity of the affected site. The vulnerability does not impact availability. The medium CVSS score reflects moderate risk due to required privileges and the nature of the impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the vulnerable widget. Monitor for updates from the plugin vendor or WordPress plugin repository regarding patches or mitigations.