The Nexter Extension plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) in its 'nxt-year' shortcode. This vulnerability allows authenticated users with at least Contributor privileges to inject malicious scripts due to improper input neutralization and output escaping. These scripts execute in the context of users who access the injected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to 4.4.1. The CVSS 3.1 score is 6.4, reflecting a network attack vector with low attack complexity and requiring privileges but no user interaction. No patch or official fix information is currently available.

An attacker with Contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of users viewing the affected pages, potentially compromising user sessions or performing unauthorized actions within the context of the victim's browser. The impact includes limited confidentiality and integrity loss but no availability impact. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the vulnerable 'nxt-year' shortcode if possible. Monitor official vendor channels for updates and apply patches promptly once released.