The Community by PeepSo WordPress plugin suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. The flaw exists in the handling of the 'content' parameter, allowing authenticated administrators to inject arbitrary scripts. These scripts execute in the context of users visiting the injected pages. The vulnerability affects multi-site setups and installations with unfiltered_html disabled. The CVSS 3.1 base score is 4.4, reflecting network attack vector, high attack complexity, high privileges required, no user interaction, scope change, and low impact on confidentiality and integrity.

An authenticated attacker with administrator privileges can exploit this vulnerability to inject malicious JavaScript code that executes in the browsers of users viewing the compromised pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or defacement, but does not affect availability. The vulnerability is constrained to multi-site WordPress installations and those with unfiltered_html disabled, limiting its scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should restrict access to trusted users only and consider disabling or limiting multi-site features if feasible. Monitoring for suspicious administrator activity may help detect exploitation attempts. Avoid enabling unfiltered_html capability to reduce risk.