This vulnerability involves improper input neutralization in the Breaking News Ticker plugin from Amitythemes.com, which allows stored cross-site scripting attacks. Specifically, user-supplied input is not properly sanitized before being included in web pages, enabling attackers to inject malicious scripts that persist and execute when other users view the affected content. The issue affects all versions up to 2.4.4. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, requiring privileges and user interaction, with impacts on confidentiality, integrity, and availability at a low level. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of users viewing the Breaking News Ticker content, potentially leading to information disclosure, session hijacking, or other client-side impacts. The vulnerability affects confidentiality, integrity, and availability at a low level. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or limiting use of the Breaking News Ticker plugin to reduce exposure. Applying web application firewall (WAF) rules to detect and block XSS payloads may provide temporary mitigation. Monitor vendor channels for updates and patches.