The WP Voting Contest plugin for WordPress, versions up to 5.8, contains a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This allows attackers with high privileges and user interaction to inject malicious scripts that can impact confidentiality, integrity, and availability to a limited extent. The vulnerability has a CVSS 3.1 base score of 5.9, reflecting medium severity with network attack vector, low attack complexity, and requiring privileges and user interaction.

Successful exploitation can lead to limited confidentiality, integrity, and availability impacts via stored XSS. An attacker with high privileges and the ability to trick a user into interacting with malicious content could execute scripts in the context of the affected site. This may result in session hijacking, defacement, or other client-side impacts. However, the overall impact is limited by the required privileges and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with plugin usage and restrict privileges where possible. Monitor official sources for updates regarding patches or mitigations.