The Ungapped Widgets plugin for WordPress suffers from a stored XSS vulnerability (CWE-79) via the 'prefillvalues' parameter in the ungapped-form shortcode. This occurs due to improper neutralization of user-supplied input, allowing authenticated users with contributor or higher privileges to inject arbitrary scripts into pages. These scripts execute in the context of users who visit the compromised pages, potentially leading to session hijacking or other client-side attacks. The vulnerability affects all versions up to and including version 1. No patch or vendor advisory is currently available to confirm remediation status.

An attacker with contributor-level access or higher can exploit this vulnerability to inject malicious JavaScript code into pages generated by the plugin. This code executes in the browsers of users who view the infected pages, potentially leading to theft of session tokens, defacement, or other client-side impacts. The vulnerability does not affect availability and has limited impact on confidentiality and integrity as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Ungapped Widgets plugin if possible to prevent exploitation.