This vulnerability involves improper neutralization of input during web page generation (CWE-79) in the WP Featherlight plugin, specifically in its bundled Featherlight.js JavaScript library versions 1.7.13 to 1.7.14. Authenticated attackers with contributor-level privileges or above can inject stored cross-site scripting payloads via insufficiently sanitized user-supplied attributes. The injected scripts execute in the context of users viewing the affected pages, potentially leading to information disclosure or session hijacking. The CVSS 3.1 base score is 6.4 (medium), with attack vector network, low attack complexity, privileges required, no user interaction, and impacts on confidentiality and integrity but not availability. There is no vendor advisory or patch information available at this time.

An attacker with contributor-level or higher access can inject arbitrary scripts that execute in the browsers of users who view the infected pages. This can lead to partial confidentiality and integrity impacts, such as theft of sensitive information or unauthorized actions performed on behalf of users. Availability is not affected. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or replacing the affected plugin versions. Monitor for updates from the vendor or plugin maintainers regarding patches or mitigations.