The Interactive Human Anatomy with Clickable Body Parts WordPress plugin suffers from a stored XSS vulnerability due to insufficient input sanitization and output escaping in admin settings. Authenticated administrators can inject arbitrary web scripts that execute in the context of users visiting the injected pages. This vulnerability affects multi-site setups and installations with disabled unfiltered_html capability, impacting all plugin versions up to 2.6. The CVSS 3.1 base score is 5.5, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, scope change, and low confidentiality and integrity impacts.

An attacker with administrator-level access can inject malicious scripts that execute in the browsers of users viewing the affected pages. This can lead to theft of user credentials, session hijacking, or other malicious actions within the context of the affected site. The vulnerability does not impact availability. The scope is changed, meaning the vulnerability affects resources beyond the attacker’s privileges. This vulnerability only affects multi-site WordPress installations or those with unfiltered_html disabled.

No official patch or fix is currently available for this vulnerability. Administrators should monitor the vendor's advisory for updates. Until a fix is released, restrict administrator access to trusted users only and consider disabling or removing the plugin in multi-site environments or where unfiltered_html is disabled. Review and sanitize any input in admin settings manually if possible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.