The Fast Velocity Minify plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to insufficient input sanitization and output escaping in admin settings. This allows authenticated administrators on multi-site or restricted installations to inject arbitrary scripts that execute in the context of users viewing the injected pages. The vulnerability affects all versions up to and including 3.5.1. The CVSS 3.1 base score is 4.4, reflecting a network attack vector requiring high privileges and no user interaction, with partial confidentiality and integrity impact and no availability impact.

An attacker with administrator-level privileges can inject malicious scripts that execute in the browsers of users who visit the compromised pages, potentially leading to session hijacking, privilege escalation, or other script-based attacks. The impact is limited to multi-site WordPress installations or those where unfiltered_html is disabled. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider disabling or limiting the use of the Fast Velocity Minify plugin in multi-site or restricted HTML environments. Monitor vendor channels for updates and apply patches promptly once released.