The WP Carticon plugin for WordPress suffers from a stored XSS vulnerability due to improper neutralization of input in the 'carticon_js_script' parameter. Authenticated administrators can exploit this flaw to inject malicious scripts into pages, which execute upon page access by users. This vulnerability affects all versions up to 1.0.0 and is limited to multi-site environments or installations where unfiltered_html is disabled. The CVSS 3.1 vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

An attacker with administrator privileges on affected WP Carticon installations can inject persistent malicious scripts into pages. These scripts execute in the context of users visiting the injected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability only affects multi-site WordPress setups or those with unfiltered_html disabled, reducing the attack surface.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is released, restrict administrator access to trusted users only and consider disabling or removing the WP Carticon plugin in multi-site environments or where unfiltered_html is disabled. Applying strict input validation and output escaping in custom code may help mitigate risk but is not a substitute for an official fix.