The List Sub Pages plugin for WordPress suffers from a stored XSS vulnerability (CWE-79) due to insufficient input sanitization and output escaping of the 'title' parameter. Authenticated attackers with Contributor-level privileges can inject arbitrary JavaScript code into pages, which executes upon page access by any user. This vulnerability affects all versions up to and including 1.0.6. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and impacts on confidentiality and integrity but not availability. No patch or official remediation guidance has been provided yet.

An attacker with Contributor-level access can inject persistent malicious scripts into pages via the 'title' parameter. This can lead to unauthorized actions performed in the context of other users viewing the infected pages, potentially compromising confidentiality and integrity of user data. There is no reported impact on availability. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the vulnerable plugin. Monitor for updates from the vendor or security advisories to apply patches once released.