The CC Child Pages plugin for WordPress suffers from a stored XSS vulnerability via the 'child_pages' shortcode. The issue is caused by improper neutralization of input in the 'show_child_pages' function, specifically in the handling of the attributes use_custom_link, use_custom_link_target, use_custom_thumbs, and use_custom_excerpt. Authenticated users with contributor-level access or above can exploit this to inject arbitrary JavaScript that executes in the context of users visiting the injected pages. This vulnerability affects all versions up to and including 2.0.0.

Successful exploitation allows an authenticated contributor or higher to inject persistent malicious scripts into pages, which execute in the browsers of users who view those pages. This can lead to theft of user credentials, session hijacking, or other client-side attacks. The vulnerability does not affect availability but impacts confidentiality and integrity. The CVSS vector indicates network attack vector, low attack complexity, privileges required at low level, no user interaction needed, and scope change, with partial impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the CC Child Pages plugin if possible. Monitor for updates from caterhamcomputing regarding a security patch.