The ParityPress – Parity Pricing with Discount Rules plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) via the 'Discount Text' input field. Due to inadequate sanitization and escaping, authenticated administrators can inject malicious scripts into pages. These scripts execute when users view the injected pages, potentially leading to limited confidentiality and integrity impacts. The vulnerability affects multi-site installations or those with unfiltered_html disabled. The CVSS 3.1 base score is 4.4, reflecting network attack vector, high attack complexity, high privileges required, no user interaction, scope changed, and low impact on confidentiality and integrity. There is no vendor-provided patch or advisory available at this time.

An authenticated attacker with administrator-level permissions can inject stored malicious scripts into the 'Discount Text' field. These scripts execute in the context of users viewing the affected pages, potentially allowing limited disclosure or modification of information accessible to those users. The vulnerability does not affect availability and requires high privileges and specific WordPress configurations (multi-site or unfiltered_html disabled). No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit administrator access to trusted users only and consider disabling or removing the ParityPress plugin in multi-site or unfiltered_html-disabled environments. Monitor vendor channels for updates and apply patches promptly once available.