The 'A Simple Multilanguage Plugin' for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) in its 'asmp-switcher' shortcode. This occurs because the plugin does not properly sanitize or escape user-supplied attributes, allowing authenticated users with contributor or higher privileges to inject malicious scripts. These scripts execute in the context of any user who views the injected page, potentially leading to session hijacking or other script-based attacks. The vulnerability has a CVSS v3.1 base score of 6.4, indicating a medium severity level. No patch or remediation guidance is currently provided by the vendor.

An attacker with contributor-level or higher access can exploit this vulnerability to inject malicious JavaScript code that executes in the browsers of users who visit the compromised pages. This can lead to information disclosure such as session tokens or other sensitive data accessible via the browser context. The vulnerability does not impact availability but affects confidentiality and integrity. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the 'A Simple Multilanguage Plugin' if possible. Monitor for plugin updates from the vendor that address this vulnerability.