The Traffic Manager plugin for WordPress contains a stored cross-site scripting vulnerability due to improper neutralization of input in the 'page' parameter of the 'UserWebStat' AJAX function. This allows unauthenticated attackers to inject malicious scripts that persist and execute in the context of users visiting the injected pages. The vulnerability affects all versions up to 1.4.5. The CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges or user interaction required, with scope changed and partial confidentiality and integrity impact but no availability impact. There is no vendor advisory or patch link provided, and no known exploits have been reported.

Successful exploitation can lead to execution of arbitrary scripts in the context of users visiting the affected pages, potentially resulting in theft of user credentials, session hijacking, or other malicious actions impacting confidentiality and integrity. The vulnerability is exploitable remotely without authentication or user interaction. There is no reported impact on availability. No known active exploitation has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the Traffic Manager plugin if feasible. Applying web application firewall (WAF) rules to detect and block malicious input targeting the 'page' parameter may provide temporary mitigation. Monitor official kaizencoders or WordPress plugin repositories for updates or patches addressing this vulnerability.