The Taeggie Feed plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) in all versions up to 0.1.10. The issue is due to the plugin's render() method directly inserting the user-supplied 'name' attribute into a <script> tag's id attribute and inside a jQuery.getScript() call without proper sanitization or escaping. This flaw allows authenticated users with contributor-level privileges or higher to inject malicious JavaScript code that executes in the context of any user viewing the compromised page. The vulnerability has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), indicating network exploitable with low attack complexity, requiring privileges, no user interaction, and causing partial confidentiality and integrity impact with no availability impact. No patch or vendor advisory is currently available, and no exploits are known in the wild.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the taeggie-feed shortcode. These scripts execute in the browsers of users who visit the affected pages, potentially leading to partial confidentiality and integrity compromise such as session hijacking or content manipulation. The vulnerability does not impact availability. The medium CVSS score reflects the need for authenticated access and the partial impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling the Taeggie Feed plugin if feasible. Monitor for updates from the vendor or plugin maintainers regarding patches or mitigations.