The Companion Auto Update WordPress plugin (up to version 3.9.2) contains a stored cross-site scripting vulnerability (CWE-79) via the 'update_delay_days' parameter. This occurs due to insufficient input sanitization and output escaping, enabling authenticated administrators on multi-site installations with unfiltered_html disabled to inject arbitrary scripts. These scripts execute in the context of users visiting the injected pages, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 base score of 5.5, reflecting medium severity with network attack vector, low attack complexity, and requiring high privileges without user interaction.

An authenticated attacker with administrator privileges on a multi-site WordPress installation can inject malicious scripts that execute in the browsers of users who visit the compromised pages. This can lead to limited confidentiality and integrity impacts, such as theft of user session data or unauthorized actions performed on behalf of users. Availability is not affected. The vulnerability requires high privileges and only affects installations with unfiltered_html disabled.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and consider enabling unfiltered_html if appropriate. Monitor official papin plugin advisories for updates or patches addressing this vulnerability.