The Multiple Post Type Order plugin for WordPress suffers from a stored XSS vulnerability due to improper neutralization of input in the 'mpto' shortcode. This allows authenticated users with contributor or higher privileges to inject arbitrary JavaScript into pages, which executes in the context of other users viewing those pages. The vulnerability affects all versions up to and including 1.10.0. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required (contributor), no user interaction needed, and impacts confidentiality and integrity with no impact on availability.

An attacker with contributor-level access or higher can exploit this vulnerability to inject malicious scripts that execute in the browsers of users who visit the compromised pages. This can lead to unauthorized actions performed on behalf of users, theft of sensitive information, or other client-side impacts. The vulnerability does not affect availability but impacts confidentiality and integrity of user data within the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access carefully and consider disabling or removing the Multiple Post Type Order plugin if possible. Monitor for updates from the plugin vendor or WordPress security advisories to apply an official fix once available.