The janhenckens Dashboard Beacon WordPress plugin versions up to 1.2.0 contain a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This flaw allows attackers with high privileges to inject malicious scripts that execute when other users interact with the affected pages, potentially impacting confidentiality, integrity, and availability of the system. The vulnerability requires user interaction and has a low attack complexity. No official patch or vendor advisory is currently provided, and the plugin is not a cloud service.

Successful exploitation could allow an attacker with high privileges to inject and store malicious scripts that execute in the context of other users' browsers, potentially leading to partial compromise of confidentiality, integrity, and availability. The attack requires user interaction and is of medium severity based on the CVSS score of 5.9. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict high-privilege user access to trusted individuals only and consider disabling or removing the Dashboard Beacon plugin if possible to reduce exposure.