The PeepSo Core: Groups plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, the Group Description field does not adequately sanitize or escape user input, enabling authenticated users with at least Subscriber privileges to inject arbitrary JavaScript code. This code executes in the context of other users viewing the group page, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability affects all versions up to and including 6.4.6.0. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and partial confidentiality and integrity impact.

An authenticated attacker with Subscriber-level access or higher can inject malicious scripts into the Group Description field, which are then executed in the browsers of users who visit the affected group pages. This can lead to partial confidentiality and integrity compromise of user data within the application context. There is no impact on availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict Subscriber-level users from editing group descriptions if possible or implement additional input filtering at the application or web server level. Monitor the vendor's channels for updates and apply patches promptly once released.