The Terms descriptions WordPress plugin (versions ≤ 3.4.8) suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated administrators can inject malicious scripts via the plugin's admin settings, which execute when users access the affected pages. This vulnerability is limited to multi-site installations or sites with unfiltered_html disabled, increasing the attack surface in these configurations. The CVSS 3.1 base score is 4.4, reflecting network attack vector, high attack complexity, required privileges at the administrator level, no user interaction, and partial impact on confidentiality and integrity.

An attacker with administrator-level access can inject persistent malicious scripts into pages generated by the Terms descriptions plugin. These scripts execute in the context of users visiting the affected pages, potentially leading to data disclosure or manipulation limited to confidentiality and integrity impacts. Availability is not affected. The vulnerability is constrained to multi-site WordPress setups or those with unfiltered_html disabled, reducing the scope of exploitation. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — no official fix or patch is currently documented for this vulnerability. Administrators should monitor the vendor's advisory channels for updates. Until a fix is available, restrict administrator access to trusted users only and consider disabling or removing the Terms descriptions plugin in multi-site environments or where unfiltered_html is disabled if feasible.