The Broadstreet WordPress plugin versions up to 1.53.1 contain a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated administrators can inject malicious scripts via the plugin's admin settings, which then execute in the context of users visiting affected pages. This vulnerability is limited to multi-site installations or those with unfiltered_html disabled. The CVSS 3.1 base score is 4.4, reflecting a medium impact with network attack vector, high attack complexity, and requiring high privileges without user interaction. No official fix or patch has been disclosed, and the vendor has not provided remediation details.

An attacker with administrator-level access can inject persistent malicious scripts into pages managed by the Broadstreet plugin. These scripts execute in the browsers of users who visit the affected pages, potentially leading to information disclosure or session hijacking within the scope of the affected site. The vulnerability does not affect availability and requires high privileges, limiting its exploitation scope. It specifically affects multi-site WordPress setups or installations with unfiltered_html disabled.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit administrator access to trusted users only, and consider disabling or removing the Broadstreet plugin in multi-site environments or where unfiltered_html is disabled. Monitor vendor channels for updates and apply patches promptly once available.