The Fetch JFT plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated administrators can inject arbitrary scripts through the plugin's admin settings, which are then stored and executed in the context of users visiting affected pages. This issue specifically impacts multi-site WordPress setups or installations where the unfiltered_html capability is disabled. The vulnerability exists in all versions up to and including 1.8.3. No patch or official remediation has been identified in the provided data.

Successful exploitation allows an authenticated administrator to inject malicious scripts that execute in the browsers of users viewing the affected pages. This can lead to limited confidentiality and integrity impacts such as session hijacking or unauthorized actions performed on behalf of users. The vulnerability does not affect availability. The attack requires high privileges (administrator) and has a high attack complexity, reducing the likelihood of exploitation by lower-privileged users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and consider disabling or removing the Fetch JFT plugin in multi-site environments or where unfiltered_html is disabled. Monitor official vendor channels for updates or patches addressing this vulnerability.