The Community by PeepSo WordPress plugin is vulnerable to stored XSS due to improper neutralization of input during web page generation. Authenticated users with administrator privileges can inject arbitrary scripts into pages, which execute upon page access by other users. The vulnerability affects all versions up to and including 6.4.5.0 and is limited to multi-site setups or installations where unfiltered_html is disabled. The CVSS 3.1 vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, and impacts confidentiality and integrity with low severity.

An attacker with administrator-level access can exploit this vulnerability to inject malicious scripts that execute in the context of other users visiting the injected pages. This could lead to unauthorized actions performed on behalf of users or disclosure of sensitive information. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability only affects multi-site WordPress installations or those with unfiltered_html disabled, reducing the overall attack surface.

No official patch or fix is currently documented for this vulnerability. Users should monitor the vendor's advisory for updates and apply any forthcoming patches promptly. Until a fix is available, restrict administrator access to trusted users only and consider disabling multi-site functionality or enabling unfiltered_html if feasible to reduce exposure.