The WebsiteDefender wp secure plugin versions up to 1.2 suffer from a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This flaw allows attackers to inject malicious scripts that are stored and later executed in the context of users visiting the affected site. The CVSS 3.1 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability with scope changed.

Successful exploitation of this vulnerability can allow attackers to execute arbitrary scripts in the browsers of users interacting with the affected website. This may lead to partial disclosure of sensitive information, unauthorized modification of data, and disruption of service availability. The scope of impact extends beyond the vulnerable component, affecting the broader system or user environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the vulnerable plugin or applying any available temporary mitigations recommended by the vendor. Monitor official WebsiteDefender communications for updates.