The SimplyConvert plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, the 'simplyconvert_hash' option is not properly sanitized or escaped, enabling authenticated users with administrator-level access to inject arbitrary web scripts. These scripts persist and execute in the context of users visiting the injected pages. The vulnerability affects all versions up to and including 1.0. The CVSS 3.1 base score is 4.4, reflecting the need for high privileges and the potential for limited impact on confidentiality and integrity.

An attacker with administrator privileges can inject persistent malicious scripts into pages via the vulnerable option. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed in the context of other users. There is no impact on availability. Since exploitation requires high privileges, the risk is somewhat mitigated by the need for administrator access. No known exploits are currently reported in the wild.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. In the meantime, restrict administrator access to trusted users only and consider disabling or removing the SimplyConvert plugin if not essential. Review and sanitize any inputs related to the 'simplyconvert_hash' option manually if possible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.