Theater for WordPress plugin versions up to 0.18.8 suffer from a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This vulnerability allows an attacker with low privileges to inject malicious scripts that execute when other users view the affected pages, potentially leading to partial compromise of confidentiality, integrity, and availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with scope changed and low impact on confidentiality, integrity, and availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of affected users, potentially enabling theft of user data, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability to a limited extent. The medium severity reflects these impacts but also the requirement for user interaction and low privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or limiting use of the affected plugin version and apply standard WordPress security best practices to reduce risk. Monitor vendor channels for updates and apply patches promptly once available.