The SureTriggers WordPress plugin (OttoKit platform) suffers from a stored cross-site scripting vulnerability due to improper neutralization of user-supplied input in the Trigger Link shortcode. Authenticated users with contributor or higher privileges can inject arbitrary JavaScript that executes in the context of other users viewing the injected pages. This vulnerability is present in all versions up to 1.0.47. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, privileges required, no user interaction, and impact on confidentiality and integrity but not availability. No patch or official fix information is currently available, and no exploits have been observed in the wild.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the Trigger Link shortcode. These scripts execute in the browsers of users who visit the compromised pages, potentially leading to unauthorized actions or data disclosure limited to the scope of the affected site. The vulnerability impacts confidentiality and integrity but does not affect availability. Since the attacker must be authenticated with contributor privileges, the risk is limited to environments where such access is granted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or limiting use of the Trigger Link shortcode in the SureTriggers plugin. Monitor for plugin updates from brainstormforce and apply them promptly once available.