The WP Nano AD plugin for WordPress contains a stored cross-site scripting vulnerability (CWE-79) via the 'blogrole_link' parameter due to inadequate input sanitization and output escaping. Authenticated administrators can inject arbitrary scripts that execute in users' browsers when they visit the compromised pages. This vulnerability affects all versions up to and including 1.31 and is limited to multi-site installations or those with unfiltered_html disabled. The CVSS 3.1 base score is 5.5, reflecting a medium severity with network attack vector, low attack complexity, high privileges required, no user interaction, and impacts on confidentiality and integrity but not availability. No patch or official remediation level has been published by the vendor as of the provided data.

Successful exploitation allows an authenticated administrator to inject and execute arbitrary JavaScript in the context of affected WordPress pages. This can lead to unauthorized actions performed on behalf of other users, disclosure of sensitive information, or session hijacking. The impact is limited to confidentiality and integrity with no direct availability impact. The vulnerability only affects multi-site installations or those with unfiltered_html disabled, reducing the overall attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and consider disabling or limiting use of the WP Nano AD plugin in multi-site environments or where unfiltered_html is disabled. Monitor vendor channels for updates and apply patches promptly once available.