The Woodpecker for WordPress plugin suffers from a stored XSS vulnerability due to improper neutralization of input in the 'form_name' parameter of the [woodpecker-connector] shortcode. This allows authenticated users with Contributor or higher privileges to inject arbitrary web scripts into pages, which execute upon page access by other users. The vulnerability affects all versions up to and including 3.0.4. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required at low level, no user interaction, and impacts confidentiality and integrity with no impact on availability.

Successful exploitation allows an authenticated contributor or higher to inject malicious scripts that execute in the context of other users viewing the affected pages. This can lead to unauthorized actions or data disclosure limited to the confidentiality and integrity impact as per CVSS 6.4. There is no indication of availability impact or known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access and above to trusted users only. Consider disabling or removing the Woodpecker for WordPress plugin if possible to mitigate risk.