The Magical Posts Display plugin for WordPress suffers from a stored XSS vulnerability (CWE-79) due to improper neutralization of input in the 'mpac_title_tag' parameter within the Magical Posts Accordion widget. Authenticated users with Author privileges or higher can inject arbitrary HTML/JavaScript code because the plugin does not sufficiently sanitize or escape user-supplied HTML tag names. This code executes in the context of any user who views the compromised page, potentially leading to session hijacking or other script-based attacks. The vulnerability is present in all versions up to 1.2.54. There is no indication of known exploits in the wild or an available patch at this time.

An attacker with Author-level access or higher can inject persistent malicious scripts into pages using the vulnerable widget. These scripts execute in the browsers of users who visit the affected pages, potentially leading to information disclosure, session hijacking, or other client-side impacts. The vulnerability does not affect availability and requires authenticated access, limiting its scope. The CVSS score of 6.4 reflects a medium severity with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level access to trusted users only and consider disabling or removing the Magical Posts Accordion widget if feasible. Monitor official vendor channels for updates or patches addressing this vulnerability.