The Related Posts Lite plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to insufficient input sanitization and output escaping in admin settings. Authenticated administrators can inject arbitrary scripts that execute on page load in multi-site or restricted HTML environments. This vulnerability affects all versions up to 1.12. The CVSS 3.1 vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, and impacts confidentiality and integrity with a scope change.

An attacker with administrator-level access can inject malicious scripts that execute in the context of users visiting the affected pages, potentially leading to data disclosure or integrity issues. The vulnerability does not affect availability. Since exploitation requires high privileges and affects multi-site or restricted HTML configurations, the impact is limited to environments meeting these conditions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider disabling or replacing the Related Posts Lite plugin in multi-site or unfiltered_html-disabled environments to reduce risk.